Cybersecurity
Understand your cyber risks and strengthen your business.
We help you understand what needs protecting, where the weaknesses are and which actions matter most. Our work follows an agreed scope, with clear responsibilities, approved changes and evidence of the improvements made.
01 · The problems
Start with what could go wrong.
We describe security in terms of the business problems it prevents, not the tools involved.
Account takeover
Stolen or guessed passwords used to get into email, finance or admin accounts.
Unsafe access
Staff, former staff or suppliers with more access than they need.
Exposed systems
Out-of-date or misconfigured devices and services that attackers can reach.
Malicious email
Phishing, fake invoices and messages made to look as if they come from you.
Data loss
Important files deleted, encrypted or copied without permission.
Operational disruption
An incident that stops the systems your business depends on.
02 · What we cover
Seven areas, agreed with you.
We agree the actual systems and tasks before work starts. An engagement can include any of these areas.
Risk assessment and security planning
Map important systems, data and business dependencies, assess existing controls and agree a practical improvement plan. You get a baseline, priorities, named action owners and a record of remaining risk.
Identity, access and email security
Review user and administrator access, multi-factor authentication, account recovery and staff joining or leaving. Strengthen mailbox protection and domain authentication without breaking genuine business email.
Device, cloud and network protection
Review the agreed computers, servers, cloud services, remote access and network controls, then implement approved updates, encryption and protection. We record what is covered and who maintains each control.
Vulnerability assessment and remediation
Authorised configuration reviews and appropriate scanning of agreed assets. We validate findings, rank them in business context, coordinate fixes and retest.
Monitoring and incident coordination
Review agreed alerts and log sources, investigate suspicious activity and escalate incidents to your named contacts. Monitored systems, hours and responsibilities are defined in your engagement.
Backup, recovery and resilience
Review what is backed up and how it is protected, test that it can actually be restored, and agree incident contacts and recovery priorities.
People, suppliers and governance
Practical staff guidance, reporting routes, access procedures and supplier security reviews, plus clear explanations that help management make decisions.
03 · How it works
Assess, improve, and prove it.
Every engagement starts with a written scope and authority: what is in scope, who your contacts are and how access is approved. Then the work follows five stages.
- 1
Assess
Map important assets and review the current security baseline.
- 2
Prioritise
Rank findings by business impact and agree the actions that matter most.
- 3
Improve
Implement approved changes with your team or IT provider.
- 4
Verify
Check that each intended improvement actually works.
- 5
Review
Keep monitoring, response and recovery arrangements current as your business changes.
What you see
For each finding: the weak point, why it matters to the business, the agreed action and the evidence that it worked. A ticket closed by a supplier isn't proof that a weakness is fixed, so we retest before anything is marked verified.
- Open
- Planned
- Implemented, awaiting verification
- Verified
- Accepted by you
04 · What you receive
Clear records, not jargon.
- A clear assessment of your current security baseline
- A prioritised action plan with named owners
- Records of the changes agreed and implemented
- Plain reporting on verified improvements and remaining risks
- Where included: defined monitoring, incident coordination, recovery preparation and staff guidance
05 · Clear boundaries
What we agree up front.
- Monitoring and response
- Which systems are watched, during which hours, who reviews alerts and what authority we have to act are all set out in your engagement before work begins.
- Scans and penetration tests
- A vulnerability scan is not a penetration test. Specialist testing needs a separately confirmed service and a written scope.
- Frameworks and compliance
- Recognised security frameworks inform our planning. They don't certify the service or establish legal compliance.
- Your decisions
- Notification, insurance and legal decisions stay with your designated decision makers and advisers.
06 · Questions
Cybersecurity questions.
What does your cybersecurity service cover?
We agree the systems and tasks with you. This can include security assessment, account and email protection, device and cloud configuration, vulnerability remediation, monitoring, incident coordination, recovery preparation and staff guidance.
Can you work with our existing IT provider?
Yes, where agreed. We define responsibilities with your team and providers, coordinate approved changes and check the results. You can see which actions we own and which depend on others.
Do we need to buy new security tools?
We begin with your existing environment and controls. If an additional tool or licence is needed for the agreed work, we explain its purpose and get your approval first.
Do you monitor our systems at all hours?
Your engagement defines what is collected, when it is reviewed and how we respond. We explain the monitored systems, review hours and response arrangements before work begins.
Can you help if an incident happens?
Incident support depends on the agreed service and authority. We define contacts, responsibilities and escalation in advance, including when specialist partners are needed. Your service agreement explains how to reach us and what response is included.
Can you promise we'll never be hacked?
No. No service can prevent every incident. We help reduce identified risks, improve agreed controls and prepare your business to detect, respond and recover.
Is a vulnerability scan the same as a penetration test?
No. A scan identifies potential weaknesses using a defined method. A penetration test uses a separate specialist scope and method. We explain which type of assessment is included before work starts.
How does this connect with brand protection?
Cybersecurity addresses your systems and access. Brand protection addresses outside misuse of your identity and rights. When a campaign affects both, we link the evidence and coordinate the two workstreams.
Next step
Find out where you stand.
Tell us about your systems, your IT setup and what concerns you. We'll discuss the relevant scope and next steps.
Under active attack right now? Disconnect affected systems where it's safe to do so, contact your IT or incident response provider, and report crime to the relevant authorities.