Small and mid-sized business
Someone has started asking you questions about security: an insurer, a large client, or a regulator. You do not have a security team. Here is what actually needs to happen, in plain terms.
What you are actually dealing with
Most small organizations arrive here because of one of three things. A cyber insurance renewal asked whether you have multi-factor authentication and monitoring. A larger client sent a security questionnaire as a condition of the contract. Or something happened — a fraudulent invoice, a compromised mailbox — and the question is now whether it is over.
None of those require an enterprise security program. They require a small number of specific things done properly, and an honest answer about which ones you actually need.
We will tell you when the answer is cheaper than hiring us. Fixing your Microsoft 365 configuration and turning on the logging you already pay for is often most of the benefit, and that is a short engagement, not a retainer.
What this will not be
- A three-year program when you asked about an insurance question
- A proposal full of terms nobody explained to you
- A retainer you cannot exit
- An invoice larger than the quote because scope moved
- A recommendation to buy a product we happen to resell — we do not resell any
A scoping call is free and carries no obligation. We would rather you came back in two years than bought something now that did not fit, so if a cheaper fix solves your problem we will point you at it.
Start here
Most small organizations need the first one or two on this list and nothing else. We will say so if that is you.
Security assessment
Almost always the right first engagement. Short, fixed scope, and a plain list of what is actually exposed. If you run Microsoft 365, most of the findings are configuration changes you already own the license for.
Security assessmentManaged detection & response
Someone watching outside your working hours, without you building a security team. Start at the Shield tier.
Managed detectionCompliance & security readiness
When a client questionnaire or an insurer is driving this, we work out what actually binds you before anyone buys anything.
Compliance readinessPenetration testing
Where a client contract specifically requires evidence of testing. Scoped to the requirement rather than to our convenience.
Penetration testingIncident response
If something is happening right now, report it on the contact form under "Incident response" rather than reading further.
Incident responseFrequently asked questions
Cost, scope, timelines, and what the jargon means. Written for people who do not do this for a living.
Read the FAQMFA is a second check when you sign in, usually a phone prompt. EDR is software on your computers that spots suspicious behavior. SIEM collects logs so someone can search them afterwards. SOC is the team watching those alerts.
If a vendor cannot explain what you are buying in sentences like those, that is information about the vendor.
Ask before you buy anything
A free call, in plain English, with no obligation. Often the answer is to fix something you already pay for.