Service
Cybersecurity and risk
A clear picture of your exposure, and a sequence for closing it that a small team can actually finish.
The problem
Things we hear in the first call.
“Our insurer sent a questionnaire and we could not answer half of it.”
“Someone in finance nearly paid an invoice that was not real.”
“We bought a security product last year. I could not tell you if it is switched on.”
What we do
Risk assessment
What you hold, who can reach it, and what would actually hurt. Findings ranked by consequence, not by scanner severity.
Identity hardening
Multi-factor authentication, conditional access, privileged account separation, and the removal of accounts nobody owns.
Endpoint and email defense
Managed detection on devices, email authentication and filtering, and the payment-fraud controls that stop the common invoice attack.
Backup and recovery you can prove
Backups that are isolated from the systems they protect, tested on a schedule, with the result written down.
Incident response plan
Who decides, who calls whom, what gets isolated first, and which obligations start the clock. Short enough to be used under pressure.
Awareness training
Short, specific sessions about the attacks your staff will actually see. No annual video nobody remembers.
How an engagement runs
Durations are typical for a company of 10 to 250 people. Scope is confirmed before anything starts.
Assess
Interviews, configuration review, and external exposure check. You get a plain-language risk register.
Prioritize
We agree the order of work against your risk tolerance, budget, and the disruption each change creates.
Remediate
Controls implemented in sequence, highest consequence first, with each change documented as it lands.
Verify and review
Re-test what was fixed, retire stale accounts and rules, and update the register as the business changes.
What you get
Documents and access you keep, whether or not the engagement continues.
- Risk register ranked by consequence
- Remediation plan with owners and dates
- Incident response plan and contact tree
- Restore test evidence
- Insurance questionnaire support pack
- Quarterly review record
Common questions
Most attacks are not aimed at anyone in particular. They look for exposed remote access, reused passwords, and mailboxes without multi-factor authentication. Size affects the consequence, not the likelihood.
Rarely first. A test tells you what an attacker could do to a system you have not hardened yet, which you already know. Fix identity, patching, and backups, then test to confirm.
Done badly, yes. We choose controls with the friction in mind and roll them out with an explanation, because a control staff route around protects nothing.
The response plan and contact tree are among the first things we produce, so the sequence is agreed in advance. We work the incident with you, including coordination with your insurer and legal counsel.
We select and configure managed detection, then make sure alerts reach a named person with the authority to act. Where continuous monitoring is part of a managed support agreement, the coverage and the escalation path are written down before it starts.
Know your exposure before someone else finds it.
A 30-minute call, no obligation. Send a request and we confirm a time by email within one business day.
Book a consultation