Path 1
Audit, customer, or board pressure
Start from the pack you have to hand over. Work backward to the evidence and the controls. A questionnaire, ISO date, or council pack is the outcome, not a fishing trip.
SU-02 · Situation
Which situation are you in?
Name the pressure. Then pick the door that matches who you are.
Path 2
Something new went live without the controls
Cloud, contact centre, or a floor change. Identity, logging, and rollback were “next sprint.”
Path 3
Alerts with no one to wake
Tools fire. Sunday night has no bench. The mailbox is not an on-call.
SU-03 · Doors
Same craft. Different door.
One practice. Three ways in, depending on who you are when the phone rings.
Small shop. Real threats.
You are the IT department. We are the night shift.
Office, warehouse, server room, staff laptop. SOHO, SMB, or SME. Nobody to wake at 1 a.m.
See how we cover the floorNew workplace. Old holes.
Ship the new stack. Don’t process the same email twice.
Cloud, contact centre, and workplace programs that went live before security did.
See a modernization buildPublic trust. Quiet operations.
If it hits the news, it needed a timeline yesterday.
Audit, privacy, thin IT, change windows, and a human who answers after hours.
See the public-sector patternSU-04 · Offers
Assess. Build. Operate.
Three things you can buy. Greenfield, we stand it up. Existing, we take ownership of what you already run. Each is scoped in writing. Then we deliver with Map. Design. Run.
Assess
See the gaps
Blank sheet or live estate. Gap review, tabletop, architecture review, AWS Well-Architected Review, AWS Cloud Adoption Framework, and Microsoft Cloud Adoption Framework. You leave with findings, owners, and a plan you can buy against.
Build
Put controls in production
Stand up a greenfield, or take the estate you already have and close the holes. Governance, risk and compliance, cloud security, detection, hardening. Named owners on handover.
Operate
Run it, or take the keys
Operate what we just built, or take ownership of the stack you already run. Fractional chief information security officer and around-the-clock triage. Expand as you need.
SU-05 · Delivery
Map. Design. Run.
After you choose Assess, Build, or Operate, this is how the work ships. Greenfield, you see the drawing before anyone buys a box. Existing, we map what is live and take it from there.
01
Map
Greenfield: obligations and identities before spend. Existing: policy versus production, written. Either way you get a map you can hold us to.
02
Design
New architecture, or the control set that fits the iron you have. Program, tooling, Zero Trust Network Access, recovery, on one drawing.
03
Run
We operate the new stack, or take the keys to what is already there, until your people can hold it. Exit is in the design.
SU-06 · Scope of work
What we actually do.
Named practices, staffed by the same people who write the plan. GRC, cloud, detection, hardening, leadership, and 24/7 triage sit on one drawing.
GRC on eramba
Implement and operate GRC in eramba: risk, compliance, policies, assessments, incidents, and the workflows that keep ISO 27001 and similar programs alive. Flat-fee GRC instead of a module catalogue. We configure it so people use it.
Fractional vCISO
Security leadership on a retainer: board reporting, policy, vendor pressure, incident counsel, and the unglamorous work of making owners actually own controls. A CISO function you can staff without a full-time seat.
Security engineering
Defensive build work informed by MITRE ATT&CK and SOC operating principles: detection design, identity, logging, and CloudSec on AWS and Azure. Engineering, not a black-box appliance.
Agentic AI security
Threat models, tool-use boundaries, secrets handling, evaluation, and governance for systems that act. If the agent can change production, it gets the same scrutiny as a privileged human.
FinOps
Cloud cost with security constraints attached: idle attack surface is a bill and a risk. We line spend, tagging, and control coverage so finance and security argue from the same numbers.
Security leadership
Strategy, operating cadence, and hiring plans for teams that cannot yet name a security org chart. We write the program you can hand to the next internal lead without a cliff-edge.
Cloud engineering
Migrating workloads to AWS and Azure, the vendor management that comes with it, BAU ops, and Infrastructure-as-Code so the landing zone is repeatable. Build, run, and hand over, not a one-off lift.
Threat modeling
Map how the system actually fails, then harden it against CIS, NIST CSF, and ISO 27001. The model drives control selection, not a generic checklist dropped on the architecture after the fact.
Defensive security
Vendor recommendation and strategy, then configuration of hosts, network, applications, and devices. Monitoring and testing so the build is proven, not assumed.
SU-07 · Operations
We will wake someone.
Inside Operate: monitoring design plus 24/7 triage. Named SLAs for acknowledge, update, and escalate. Playbooks mapped to the tools you actually run. The first hour is covered; longer forensics is an IR partner if you want one.
01 · Foundation
Secure foundation
- Identity, endpoint, email, backup, and logging turned on
- MSP-shaped: scoped, billed like managed IT
- The baseline everything else pages off
02 · Detect
Detect and notify
- Wire Defender, Sentinel, CrowdStrike, GuardDuty, Connect, firewalls into the notification path
- Named alert classes, named severity, named who gets paged
- Alerts are on 24/7. A trained engineer is on-call 24/7 to triage
03 · Triage
24/7 triage
- On-call engineer who acknowledges, classifies, and coordinates
- Sev-1/2: acknowledge, classify true / false / needs customer / needs vendor, first actions from a written playbook
- Containment only for actions you pre-authorize. Ticket with timeline and evidence. Escalate to your IT, our senior, or an IR retainer partner
SU-08 · Also in the kit
Adjacent work we will not hide in a footnote.
API security
Authn/z, abuse cases, and contract testing for the interfaces your agents and partners actually call.
ZTNA / SASE
Zero-trust access on Cloudflare: replace the castle VPN with identity-aware paths.
TPRM
Third-party risk that fits the real vendor list, not a 400-question PDF no one returns.
AI governance
Use-case intake, data classes, and human-in-the-loop rules that survive an audit.
ISO 27001
Implementation, not a binder. Statement of Applicability tied to eramba records.
Vulnerability ops
A rhythm: discover, prioritize, patch or accept, prove it. No dashboard tourism.
Networking
Deploying and managing UniFi appliances and camera systems, Zero Trust Network Access, and the floor network they sit on.
DRaaS counsel
Recovery objectives that match the business, then the platform choice, not the reverse.
SU-09 · Plain answers
Questions we would ask us.
Are you an MSSP or a 24/7 SOC?
We deliver managed security operations: monitoring design plus 24/7 triage. We design the monitoring and notification layer, then a trained engineer is on-call 24/7 to acknowledge, triage, and coordinate response. We are not a co-located SOC. We do not staff a hunt floor, and we do not promise undetected-threat hunting.
Do you monitor 24/7?
Alerts are on 24/7. A trained engineer is on-call 24/7 to triage. Continuous hunt is out of scope unless we add an MDR partner.
Will you contain?
Yes, for the actions you pre-authorize (isolate a host, disable a token, kill a session). Everything else we coordinate with your IT, our senior, or an IR partner.
Why eramba?
Most GRC suites charge by module, user, or framework. eramba is open GRC software used for risk, compliance, policies, assessments, and related workflows, with a simple enterprise model. We implement it so the register matches how you actually work.
How fast can we start?
A scoping conversation this week. A written plan before tools. Implementation on a calendar you can show a board. We will not promise “protected in 48 hours” unless the work is that small.
Where do you work?
Consultation is global. Delivery is remote-first. If a control or a regulator needs data to stay in a region, we say so in the design, including when eramba should be on-prem rather than SaaS.
Will we be stuck with you?
No. Handover is a deliverable: system ownership, documentation, and a named internal successor.
What do you not sell?
We are not a co-located SOC. We do not staff a hunt floor, promise undetected-threat hunting, or guarantee detection. Continuous hunt is out of scope unless we add an MDR partner. Pricing is in the statement of work, not a mystery endpoint tax.
SU-10 · Book
Book a 20-minute security assessment.
You receive: a named situation (audit/board, cloud/AI, or alerts), a recommended offer (Assess, Build, or Operate), and the first three actions. We reply with a calendar slot. Chat is open if that is faster.