Services

What the practice is built to do.

Six areas, written as work rather than as products. Each one names what is in scope and what this preview is not claiming.

Security operations

A way to notice, decide, and act that a real team can keep.

Most environments do not need another console. They need a short path from “something changed” to “someone who knows the estate did something about it.” The work is what is worth collecting, what gets ignored on purpose, who is on the hook, and how the next person learns it.

In the work

Sources that match the systems already running
Triage that ends in a decision, not a queue
Roles for the first hour of an incident
A cadence for reading what the alerts were trying to say

Outside it

A staffed, follow-the-sun SOC presented as if it already exists
A promise that another tool, by itself, closes the risk

Network defense

The paths in and across the network, lined up with how the organization actually works.

Incidents still travel the network you already have. Segmentation, remote access, and the firewall rules nobody wants to reread are part of the security program, not a side hobby. The point is to make those controls match reality, and to leave them understandable.

In the work

What may talk to what, and why
Remote access that is deliberate, not inherited
Rules checked against the business, not only against a template
Enough visibility to tell whether the design is what is running

Outside it

Replacing every device for its own sake
A diagram that is never checked against live policy

Identity and endpoints

Who can reach what, on which machines, after people change roles.

A careful network still fails open when access is stale and devices are unmanaged. This covers the directory, the exceptions, and the endpoints people actually use — including the ones that never quite made the standard image.

In the work

Access that can be explained for a role, not only a username
Joiner, mover, and leaver handled as routine
Device expectations a small team can enforce
Exceptions written down instead of remembered

Outside it

An identity program that exists only in a product brochure
Pretending one agent replaces an owner

Resilience

Backups, recovery order, and the failures currently being called fine.

Security work that cannot survive a bad day is incomplete. Resilience means knowing what has to come back, whether the copies are real, and which dependencies are one outage away from becoming the incident.

In the work

Restores that have been tried, not only jobs that stayed green
An order of recovery written before it is needed
The dependencies hiding under “the important server”
A plain account of what is not protected yet

Outside it

A backup product with no restore behind it
Treating uptime of the tool as uptime of the business

Compliance readiness

Controls mapped to work you can show, with the thin spots named.

Readiness is evidence and habit, not a binder. The work lines a program up with the requirements you actually have — including defense-contract expectations such as CMMC, the Cybersecurity Maturity Model Certification, where they apply — and says where the story would not hold up.

In the work

A control map tied to systems, not slogans
Evidence someone outside the project can follow
Gaps ranked by what a reviewer, or an attacker, would notice
Language leadership can repeat without embellishing it

Outside it

Acting as a certification body or official assessor
Policies no one intends to run

Advisory

A short list for people who have to choose, not a longer catalog of tools.

Someone has to decide what not to do. Advisory work is the translation: what the risk is, what it costs to leave it, what it costs to move it, and what can wait without kidding anyone.

In the work

Decisions framed for the person who owns the budget
Tradeoffs between fix, mitigate, and accept
Help unwinding a stack that grew by accumulation
A record of what was recommended, and what was declined

Outside it

Slideware with no owner on the other side
Urgency used as a sales tactic