Cybersecurity
Assess the risk, deploy the controls, watch the network.
We protect businesses from the threats that actually reach them, and keep the evidence that the controls are working. It starts with assessment: vulnerability assessment, penetration testing and a security audit of what is already in place, followed by incident response planning for the day something gets through.
The operational side runs continuously. A network operations centre and a security operations centre watch the estate, with SIEM correlation collecting the logs and the controls sitting at the edge: firewall, web application firewall, intrusion detection and prevention, load balancing and DDoS protection.
People are part of the perimeter, so the training matters as much as the hardware. We run security awareness programmes for staff, so the phishing mail, the invoice that changed bank details and the password reset are recognised rather than clicked.
Strategies are written per organisation, matched to the data you hold, the regulations you answer to and the risk you are prepared to carry. The security practice documents its own work at eesec.org.
What is included.
The work this service is scoped around. Anything outside it is agreed in writing before we start.
Vulnerability assessment
Authenticated and external scans, deduplicated and ranked by what is actually exploitable.
Penetration testing
Manual exploitation of the surfaces an attacker would work, with a prioritised report.
Security audit
What you have against what your policy, your contracts and your regulator require.
Incident response planning
A tested plan for containment, forensics, notification and recovery.
Security Operations Center (SOC)
Alert triage and escalation by analysts against a contracted response time.
Network Operations Center (NOC)
Availability and performance watch over links, hardware and services.
SIEM deployment and tuning
Central log collection, correlation rules and dashboards that stay useful after month one.
Firewall and web application firewall
Application aware filtering, segmentation and egress control at the edge.
Intrusion detection and prevention
Signature and behaviour based detection, inline where prevention is wanted.
Load balancing
Traffic spread across nodes with health checks, session handling and failover.
DDoS protection
Rate limiting, filtering and upstream mitigation for volumetric attacks.
Endpoint protection and management
Centrally managed agents with policy enforcement and isolation on detection.
Source code and application security audit
Manual review of the codebase against injection, access control and crypto faults.
Security awareness training
Short, recurring sessions for staff, with the phishing simulations to match.
Scope it, price it, decide.
Tell us what you are trying to do. We come back with the options, what each one costs and the order we would do the work in.
- AssessVulnerability assessment, penetration testing and audit
- DeployFirewall, WAF, IDS and IPS, load balancing, DDoS protection
- WatchSOC and NOC monitoring with SIEM behind it
- TrainAwareness programmes for the people who get phished
Where we are called in.
Assessment, operations and training, run by the same team so the findings do not sit in a folder.
Assess
Vulnerability assessment, penetration testing and a security audit of the current estate.
Harden
Segmentation, least privilege, patching and the configuration that keeps them honest.
Monitor
SOC and NOC cover, SIEM correlation and escalation to the people who can act.
Respond
Incident response planning, playbooks and the rehearsal that proves they work.
Train
Staff awareness programmes and phishing simulations, run on a repeating cycle.
Prove
The reporting and evidence your board, your customers and your regulator ask for.
The controls we run.
Deployed, tuned and watched by us, whichever parts of the stack you need.
- Firewall
- Perimeter and internal segmentation with application aware filtering and egress control.
- Web application firewall
- Rules in front of the application, tuned against its own traffic rather than left on defaults.
- IDS and IPS
- Detection on the network and the host, inline where prevention is worth the risk of a false positive.
- SIEM
- Log collection, correlation and the dashboards an analyst can work from at 3am.
- Load balancing
- Health checks, session handling and failover in front of anything that matters.
- DDoS protection
- Rate limiting, filtering and mitigation, tested before the attack rather than during it.
- SOC
- Analyst triage of security alerts, with escalation against a contracted response time.
- NOC
- Availability and performance cover over links, hardware and services.
How a security engagement runs.
Four stages, repeated as the estate changes.
- 01
Assess
Scans, manual testing, interviews and a review of the policies you already have.
- 02
Decide
A written plan: what to fix first, what it costs and what risk it removes.
- 03
Deploy
Controls configured, tuned and documented, with the access needed to change them.
- 04
Operate
Monitoring, response, training and a monthly report on what actually happened.
Where the work happens.
The edge: filtering, segmentation and the hardware that carries it
Assessment done by hand, confirmed before it reaches the report
Awareness sessions, because most breaches arrive by email
Questions we are asked.
Do we have to take the whole stack?
No. Some organisations want the assessment and the report; others want the SOC and NOC watching the estate. The parts you take are written into the scope.
How quickly do you respond to an incident?
The response time is part of the contract and depends on the cover you take. Outside office hours there is an escalation path to the engineers who run the controls, not a queue.
Can you help with compliance evidence?
Yes. Audits, penetration test reports, awareness records and change history are kept in a form a regulator, insurer or enterprise customer will accept.
Tell us what you need to build, protect or automate.
A 30 minute call with an engineer, not a sales script. You leave with a clear next step, whether or not we work together.