How we work

Calm, scoped, and on the record.

Both services follow the same principles: an agreed scope, written authority, evidence you can check and actions you approve. Security work should lower your stress, not add to it.

01 · From enquiry to ongoing protection

Six things you can count on.

You request a review. We understand your business and the issue, agree scope and authority, set the starting point and begin the approved work. You receive actions, case updates and agreed reviews.

  1. 01

    Onboarding

    We learn how your business runs, who your existing IT providers are and what concerns you, then confirm whether the work is cybersecurity, brand protection or both.

  2. 02

    Authority

    Nothing happens without a written mandate. For cybersecurity: a scope, named contacts and approved access. For brand protection: the rights owner and who may approve reports in your name.

  3. 03

    Evidence

    We collect only what a case needs, keep original observations separate from our conclusions, restrict access and agree how long evidence is kept. Suspected scams are examined in an isolated environment, never with real credentials or payment details.

  4. 04

    Agreed actions

    Every change to your systems and every report filed in your name is approved under the agreed authority. Emergency actions are agreed in advance, with an escalation route for anything outside them.

  5. 05

    Verification

    We check that a fix works, or that reported content has actually changed, before we call it done. A closed ticket, an error page or a paused ad isn't treated as proof.

  6. 06

    Ongoing reviews

    Risks, brand references and recovery arrangements are revisited on an agreed schedule and whenever your people, systems or suppliers change.

02 · One case, two workstreams

When a scam touches both sides.

You have one relationship and one case reference. The cybersecurity workstream handles your systems and access; the brand protection workstream handles outside misuse and provider reports. When a campaign affects both, we link the evidence.

Example one

A fake customer login page

A lookalike domain hosts a copy of your login page.

Brand protection
Captures the page and how customers reach it, confirms the impersonation and pursues the host, domain and distribution reports that apply.
Cybersecurity
Checks whether any of your users or accounts were affected and coordinates approved protective action where the evidence supports it.

We record the two separately. A fake page doesn't by itself mean your systems were breached, and a page taken down doesn't mean a compromised account has been recovered.

Example two

Fraudulent payment instructions

An email that appears to come from you asks a customer to change bank details.

Both
We review the message evidence to tell a lookalike sender apart from a real mailbox compromise.
Cybersecurity
Reviews the affected company account, where authorised.
Brand protection
Addresses the impersonating domains or accounts behind it.

Customer communications and contact with banks go through your approved incident contacts.

An active system incident goes straight to the agreed incident route. It never waits for a routine brand investigation to finish.

03 · Who does what

Clear responsibilities, case by case.

These are the functions every case passes through. Each case is reviewed before reports are submitted.

You, as client or rights owner
Provide accurate brand references and authority, confirm legitimate uses, and make the business and legal decisions reserved to you.
Investigation
Reviews signals, validates each allegation, captures evidence and assesses urgency.
Reporting
Prepares submissions, manages provider cases and handles follow-up and verification.
Specialist or legal adviser
Assesses disputed rights, formal legal steps and complex or contested cases where needed.

04 · Our principles

What you can hold us to.

  • Authorised work only. We never test a system without its owner's written permission, and we never "hack back".
  • Facts kept apart from guesses. Our reports say what we confirmed, what we suspect and how sure we are.
  • No promises we can't evidence. A complaint filed is not a fake page removed, and a page removed is not permanent safety. We report each one for what it is.
  • Honest about disclosure. Some providers share a report with the business being reported. We explain when that can happen before we file.

Start here

Request a protection review.

Tell us what concerns you. We'll explain the relevant scope, the authority we'd need and what you'd receive, before any work begins.

Request a protection review