Cyber Security and Resilience Services

With an assessment of what you already have configured. In most mid-market environments a substantial share of the security capability already licensed has never been switched on, and closing those gaps requires no purchase.

The most common findings are conditional access unused, Intune licensed and not deployed, Defender policies at defaults, administrative accounts excluded from multi-factor authentication and logging available but not retained. Working through those changes the position more than most tooling purchases would, and it costs configuration time rather than licence spend.

Less than most vendors suggest and differently. The controls that carry the most weight in this market are identity, patching, segmentation, endpoint hardening and tested backup, and most of those are configuration rather than product.

We would rather find that you are already licensed for what you need than sell you something. Where a genuine gap exists we quote it separately and say why. If the assessment finds a well-configured environment, that is what the report will say.

A scan is automated, broad and frequent, and it identifies known vulnerabilities. A penetration test is manual, targeted and periodic, and it finds what a skilled person could chain together, including logic flaws no scanner detects.

They are complements, and the order matters. Testing an environment that has never been scanned spends most of the engagement on findings a scan would have surfaced for a fraction of the cost. Scan, remediate, then test what remains.

We scope and coordinate it through independent testing providers, then work the findings to closure and verify the fixes. We do not perform the testing.

That is deliberate as well as honest. There is a real independence argument for the party remediating not being the party testing. The part most often dropped after a test is the remediation programme, and a report without one is an expensive document.

Section 19 requires appropriate technical and organisational measures to secure the integrity and confidentiality of personal information. Section 22 requires notification to the Information Regulator and to affected data subjects where there are reasonable grounds to believe personal information has been accessed without authorisation.

The practical consequence is that you need the capability to establish what was accessed, which means logging and retention decided in advance rather than after the fact. Whether your overall processing complies is a question for your information officer, and we give them an accurate description of the technical position to assess.

They are two controls. The gaps we find most often sit elsewhere: administrative accounts without multi-factor authentication, legacy authentication still permitted, flat networks where one endpoint reaches everything, and backups that have never been restored.

This is not a criticism of either product. It is that the exposure in a modern environment is weighted towards identity and configuration rather than towards perimeter and endpoint alone. An assessment tells you where your specific gaps are rather than which product to add.

Segmentation first. Manufacturing equipment, building management, access control and cameras commonly sit on the same network as business systems, and separating them is usually the highest-value structural work available.

Operational technology often cannot be patched, because the vendor certified a specific configuration. That makes it an exception with compensating controls rather than a remediation target, and the compensating control that works is network isolation. This is common across the Gauteng industrial belt and it is rarely on the security shopping list.

A documented response plan with defined roles and deputies, communication templates drafted in advance, evidence preservation steps and a decided POPIA notification path.

The value is entirely in deciding it beforehand. Working out who has authority, who talks to customers and whether a notification threshold has been met, while an incident is running, produces slow and inconsistent decisions. It takes a day or two to prepare and it is the cheapest resilience work available.

Yes. Patch compliance, vulnerability remediation, access control, backup and restore evidence, logging and incident readiness all come out of the standing reporting.

These questionnaires are increasingly a condition of doing business with larger customers, and assembling the evidence retrospectively takes days and produces a weaker answer. Where the reporting already exists, answering is largely a transcription exercise.

Sometimes, and it is worth being honest that it is often bought before the basics are in place.

Detection and response adds real value on an environment that already has identity hardened, patching under control, endpoints managed and logging retained. Bought before those, it generates alerts about an environment nobody can remediate quickly, and the cost is significant and recurring. We would rather get the foundations right and then have the conversation about detection with a clear view of what it would add.

On a small environment with cloud-managed devices, no on-premises servers and no compliance obligation, a hardened Microsoft 365 tenant, managed endpoints and tested backup covers most realistic exposure.

That is genuinely a defensible position at small scale and it costs a fraction of a programme. The case for more grows with on-premises infrastructure, operational technology, regulated data, contractual security obligations or a customer base that audits you. We will tell you which of those apply to you and which do not.