Defend what is actually attacked

With an assessment, then the fundamentals. In practice that means multi-factor authentication everywhere it can be enforced, patching for internet-facing systems, removing shared and default credentials, tightening admin rights, and proving your backups restore. Those five account for the majority of realistic risk reduction for a mid-sized company and can usually be substantially done within a quarter. Detection and response are the next layer, not the first.

Managed IT keeps the estate patched, backed up and access-controlled — that is a security baseline and it matters. Cybersecurity as a practice adds adversarial testing, architecture designed for containment, tuned detection with people watching it, and a rehearsed response capability. We deliver both, and we keep them priced separately so you can see what you are paying for rather than buying a bundle where the security line is undefined.

It depends on what an hour of undetected access would cost you. Attacks do not respect office hours and ransomware deployment often happens overnight or at a weekend precisely because nobody is watching. That said, monitoring before the fundamentals are in place is the wrong order, and monitoring with no agreed containment authority just produces a faster notification of a breach you could not stop.

Yes, and we would rather get there by implementing controls properly than by writing policies to satisfy an auditor. Most of what those frameworks require — access control, change management, vulnerability handling, incident response, supplier review — is work worth doing on its own merits. We map what we implement to the relevant controls and produce the evidence as a by-product, then support you through the assessment.

Containment first, in line with the playbooks agreed in advance — isolating hosts, disabling accounts, preserving evidence. Then forensics to establish scope and entry point, recovery from verified backups, and support with regulatory and customer notification, which for GDPR means a 72-hour clock. Afterwards we run a blameless review and close the gap that allowed it. Retained clients get defined response times for exactly this.

Scope and rules of engagement are agreed in writing before anything starts: what is in scope, what techniques are excluded, testing windows, and an escalation contact who can stop the test. Denial-of-service testing is excluded by default. For fragile production systems we test a staging replica and review configuration directly rather than attacking live infrastructure.