See
See
Tenants, vendors, UAT versus prod, who can send as whom.
Pain
What you would actually say.
- The board or council pack needs residual risk with an owner and a date. Staff will not sign their own homework.
- Do not touch production, and also fix it this weekend. We need an outside pair of hands with a rollback.
- Privacy, freedom of information, records: the timeline must exist before the journalist or the request.
- Shared mailbox, camera vendor, payroll software-as-a-service, three tenants. Nobody owns the seam.
- Tools page a mailbox. Thin information technology after a departure. Sunday night has no bench. “We have antivirus” will not bind the insurer.
What we do
See. Fit. Watch. Handle. Show.
Fit
Fit
Account boundaries, logging, encryption, access reviews.
Watch
Watch
Named alert classes the CAO can understand.
Handle
Handle
24/7 human who escalates into their on-call, not a black box.
Show
Show
Who got the page, when, what was done. For FOI, insurer, board.
Illustrative scenario
Composite of work like this.
Illustrative scenario. Composite of work like this. No invented city, no made-up CISO, no claim we replaced a government SOC.
A mid-sized public body. Microsoft 365 and cloud already licensed. A queue that already feeds a third party. Three tenants because education, staff, and a vendor experiment never got cleaned up. Shared mailboxes. Change windows that are political, not technical.
We map tenants, vendors, UAT versus prod, and who can send as whom. Education work stresses staff versus student identity split. Health work stays on workplace, identity, and mail unless someone asks about clinical devices. Harden: account boundaries, logging, encryption, access reviews.
Watch is a short list of alert classes a CAO can read. Triage is a human who answers after hours and escalates into their on-call, not a black box. Prove is a timeline: who got the page, when, what was done. That pack is for FOI, the insurer, and the board. If it hits the news, the timeline already exists.
Buy path: an assessment that produces a briefing-ready one-pager, then wire, then tabletop, then a retainer with a named IR partner for breach. Quiet operations. Public trust.
End to end
Identity to response.
Identity
Staff versus student, or staff versus vendor. Who can send as whom.
Devices and mail
Shared mailboxes and the three tenants nobody meant to keep.
Cloud
UAT versus prod. The queue that already feeds a third party.
Data
Privacy and records. Encryption and access reviews that survive an auditor.
Response
24/7 human, escalate into their on-call. Timeline for FOI, insurer, board.
We don’t
Honest exclusions.
- We do not invent a municipality or quote a made-up CISO.
- We do not claim we replaced a government SOC.
- We do not touch clinical devices unless we are asked, in writing.
Engagement
Assess, then wire, then stay.
Assess
Assess
Briefing-ready one-pager: tenants, vendors, gaps, first three actions.
Wire and quiet
Wire and quiet
Boundaries, logging, the alert list a CAO can read.
Tabletop
Tabletop
Change window, vendor path, after-hours page.
Retainer
Retainer
24/7 triage plus a named IR partner for breach.
Book
Request an assessment.
Twenty minutes. Named situation, recommended next step, first three actions. We reply with a calendar slot.