03 / SECURITY

Cybersecurity

The controls your cyber-insurance assumes you already have.

Threat assessment, zero-trust architecture, endpoint defense, incident response. Built on NIST and CIS frameworks.

01 — Who this is for

SMBs facing a renewal questionnaire, a regulated industry audit, or a post-incident hardening — where the gap between what you wrote on the application and what's actually deployed is the gap an underwriter (or a regulator) will find.

02 — What you get

Concrete, in writing.

No vague “best-in-class” promises. Every engagement ships with a defined scope and a checklist you can audit.

  • 01Threat assessment against CIS Critical Controls and NIST CSF
  • 02Zero-trust architecture: identity-first access, conditional access, device posture
  • 03MFA across email, VPN, admin consoles, and line-of-business apps
  • 04EDR / XDR rollout with managed detection and 24/7 response
  • 05Security awareness training with phishing simulations and reporting
  • 06Documented incident response runbook tailored to your environment
  • 07Quarterly external penetration testing and remediation tracking
  • 08Evidence pack for audits, cyber-insurance renewals, and customer security reviews
03 — How we work

How a typical engagement runs.

  1. Step 01

    Posture assessment

    Two-week scoped assessment against CIS and NIST. Output: a written report scoring your current posture, ranked gaps, and a remediation order-of-operations.

  2. Step 02

    Prioritized remediation

    We close the highest-impact gaps first — usually identity, MFA, and endpoint. You see weekly progress against the remediation list.

  3. Step 03

    Ongoing monitoring

    Once hardened, EDR + log monitoring runs 24/7 with alerts triaged by our team. You get notified on confirmed incidents, not noise.

  4. Step 04

    Quarterly review

    Posture re-scored each quarter. New CVEs, new controls, new evidence — all rolled into the next questionnaire or audit on autopilot.

04 — Stack we run

The vendors behind the work.

Certified across the platforms most SMBs already standardize on — and independent enough to recommend something else when it's the right answer.

  • Microsoft 365 Defender / Entra ID
  • Fortinet
  • Cisco Meraki
  • EDR — CrowdStrike-class endpoint defense
  • Cisco Umbrella DNS
05 — The outcome

Audits and renewals stop being fire drills. Insurance premiums stop climbing without explanation. The next time a customer sends a security questionnaire, you fill it in 30 minutes from the evidence pack — not 30 hours from scratch. And when something does happen, the runbook tells your team what to do in the first ten minutes.

Have a renewal or audit on the horizon?

Book a 30-minute security review. We'll walk through your most recent questionnaire or audit findings, identify the three controls most likely to flag, and give you a remediation estimate.

Book a security review