See
See
We walk the office, the warehouse, and the cupboard. People, laptops, the local network, mail, remote support, backup. You get a short map and a risk list in language the owner can read.
Pain
What you would actually say.
- Tools page a mailbox. The owner is also information technology. Sunday night has no bench.
- The insurer wants multi-factor authentication coverage, a tested restore, an incident retainer, and named contacts. “We have antivirus” is not an answer.
- Shared admin, a password book, remote support on a public broker. One phish is domain-wide.
- The managed service provider, the accountant, the camera vendor, payroll software-as-a-service. Nobody owns the seam.
- The one person left. Controls rot in ninety days. The first ransomware or business-email compromise is a bad time to invent process.
What we do
A rhythm the office can live with.
You already have gear. What is missing is someone who will look at the floor, close the doors that matter, stay on the alarm, sort a real event from a printer ticket, and leave a file you can hand a banker or an insurer.
Fit
Fit
We harden what is already there: identity, devices, the network lanes, mail, recoverability, sized so Monday still opens. What we cannot close is written as an exception, not buried.
Watch
Watch
Telemetry stays narrow: sign-in abuse, a USB on a jump host, malware-like behaviour. Alerts do not land in the newsletter mailbox. After a quiet-down stretch, nights are survivable.
Handle
Handle
A serious page becomes an incident with an owner and a clock. Staff who need to do something get a normal service ticket. Containment you have pre-authorized can run without a committee at 1 a.m.
Show
Show
Coverage against the device list, the last restore that actually worked, the case timeline. The register can pull it. You are not rebuilding the story from chat.
Illustrative scenario
Composite of work like this.
Illustrative scenario. Composite of work like this. Not a named shop.
A 25 person office, or a 120 person firm with a warehouse and a server cupboard. The owner or the office manager is still IT. Staff laptops, a gateway and APs, a couple of servers, cameras, printers. Remote support was stood up on a public ID server because it was easy. Backup runs. Nobody has restored it. Alerts go to a mailbox that also gets vendor newsletters.
We look at the floor: who can log into what, which virtual LAN the cameras sit on, whether name lookups use DNS-over-HTTPS, whether USB is a free-for-all, whether the admin consoles are on the public internet. Identity and device control is the software-as-a-service plane for those laptops. The rest stays local: detection, incident cases, playbooks, ticketing, governance, risk and compliance, remote support.
Thirty days of wire-and-quiet: split admin, multi-factor authentication people will actually use, disk encryption, USB policy, staff versus printers and gadgets versus servers, DNS-over-HTTPS, remote support pinned to a private broker, Disaster Recovery as a Service with a restore that worked. Watching is narrow. After a quiet-down month, nights are survivable because junk is not paging anyone.
The first real page is a leaked mailbox or a USB insert on a jump host, not a hunt report. The on-call engineer acknowledges, takes the pre-authorized action, and writes the case in the incident book. Information technology requests stay in the request book. Risk and exceptions stay in the governance, risk, and compliance register. Three books. Do not mix them. That is the Sunday-night product.
Three books
Do not mix the books of record.
Owns means system of record. Implements means it enforces the control. Maintains means we tune the tool. Evidence is what an auditor can pull without a scavenger hunt.
Security incident
Incident casebook
Open, contain, eradicate, recover, lessons. Observables, severity, timeline. This is the only place an incident is true.
IT request
Request desk
Access, hardware, Wi-Fi down, guest VLAN exceptions. User comms after a case closes. Not IR.
Risk and audit
GRC register
Risks, controls, exceptions, evidence, audit calendar, vendors. Residual risk lives here, signed. Governance, risk, and compliance only.
On the floor
What sits in front of the office, the warehouse, and the laptop.
Local infrastructure only. Software-as-a-service appears where it is the control plane for those devices: identity, mobile device management, zero-trust edge. Hyperscaler contact-centre and cloud-native programs live on the workplace door, not here.
| Layer | Outcome |
|---|---|
| Identity and device plane | Joiners, multi-factor authentication, vault, enrollment, operating system and browser patch rings, USB and install policy, block stale devices from single sign-on |
| Host telemetry | Process, network, Domain Name System, file integrity monitoring, Center for Internet Security scoring, Common Vulnerabilities and Exposures inventory, USB-insert alerts, scripted host response. Detects. Does not own patch install or USB block. |
| Intel store | Indicators, campaigns, MITRE ATT&CK mapping; enrichment for playbooks |
| Incident casebook | Incident response process and observables. System of record for incidents. |
| Playbook runner | Alert in, enrich, open a case, optional request ticket, optional disable, drop, or revoke |
| Zero-trust edge | No inbound to admin consoles except through zero-trust access. Domain Name System, email threat, software-as-a-service posture, device client, data loss prevention, session revoke |
| On-premises fabric | Virtual LANs, zone firewall, Dynamic Host Configuration Protocol, DNS-over-HTTPS, wide-area network, Wi-Fi, intrusion detection on selected virtual LANs |
| Remote support | Helpdesk access only. Key pinning. Broker on a private virtual LAN, not a public identity server. Not privileged access management. |
| Request desk | Information technology and facilities tickets. Not incident response. |
| Governance, risk, and compliance register | Risk, control, exception, evidence, audit calendar |
| Infrastructure-as-Code | Standardized, automated, and repeatable outcomes for managing resources |
| Backup (DRaaS) | Disaster Recovery as a Service: image of hypervisors, controller, detection store, governance database. Offline or immutable copy. Restore test. Without a tested restore the availability control is incomplete. |
End to end
Identity to response, on this floor.
Identity
One identity per person. Nobody reaches an admin console without multi-factor authentication, and those consoles are reached through single sign-on, not a password taped to a monitor. If a laptop is missing its management agent, the disk is not encrypted, or the operating system is past its update deadline, sign-on is refused. When someone leaves, their access is checked against the termination list so accounts do not outlive the employee.
Devices and mail
Company laptops are enrolled before they hold company files. Disks are encrypted, screens lock, and security updates have a deadline. USB sticks and unknown gadgets are blocked on Windows and Mac. Incoming email is filtered at the company mail gateway so most phishing never reaches the inbox.
Network
The office network is split into lanes: staff, servers, printers and gadgets, cameras, guests, and the management tools that run the building. Those lanes may talk only where the zone map says they may. Name lookups go through DNS-over-HTTPS; devices are not allowed to pick a public Domain Name System server and walk around the filter. The tools that run the network and the servers are not exposed on the public internet.
Data
We can point to where important files live: which system, which network lane, which backup set. Backups are encrypted. A green “backup succeeded” light is not enough: the last time we actually restored data has a date and a ticket. Recovery keys are stored apart from the backup media so losing a laptop or a disk does not mean losing the company.
Response
A serious alert is enriched with context and opened as a security incident, not left in a log. If staff need a message (“change your password,” “bring the laptop in”), that is a service ticket, separate from the incident file. Actions we may take automatically, cut a machine off, disable an account, kill a remote session, are written down and approved in advance. The incident timeline is what leadership and auditors attach when they ask “what did we do?”
Evidence
Each layer has a control and an artifact.
If you cannot produce the artifact without hunting, it is not evidence yet.
| Layer | What it must prove |
|---|---|
| Identity and device | Lifecycle versus terminated list, MFA coverage, last login, enrollment, encryption, OS build, USB policy assignment, audit log in the detector |
| Host telemetry | Agent coverage versus the device list, config hash, CIS pass/fail, vuln aging, high-sev alert to case ID, retention setting, response-command audit |
| Intel store | Feed health, last ingest, a sighting linked to a case, SSO on the UI |
| Incident casebook | Ack and contain times, closed-case pack, detector ID mapped to the case, SOP attached |
| Playbook runner | Versioned playbooks in git, run history, failed-run log, secrets not in git |
| Zero-trust edge | App list, posture checks, access logs in the detector, diagram that admin UIs are not on the WAN |
| DNS, email, SaaS posture | Block stats, TLS-decrypt exceptions, MX coverage of all domains, last SaaS scan with an owner |
| On-prem fabric | VLAN/zone matrix, firewall export, IDS on/off per VLAN, DNS forwarder, WAN allowlist, controller backup with 2FA |
| Remote support | Broker version, client key pin, no public ID server, who has access |
| Request desk | Ticket SLA, link from a closed incident to user comms, SSO |
| GRC register | Owner and residual rating, signed exceptions, control test dates, evidence files that match this table |
| Infrastructure-as-Code | Repo and pull-request history, plan/apply logs, who can touch state |
| Backup (DRaaS) | Last successful backup, last restore-test date and ticket, key escrow |
Shared objectives
One outcome, more than one pair of hands.
| Objective | Who does the work |
|---|---|
| Least privilege to admin consoles | Identity single sign-on plus zero-trust access plus the management virtual LAN |
| Patch management | Device plane installs; host telemetry verifies the Common Vulnerabilities and Exposures item is gone |
| USB / BadUSB | Mobile device management on Windows and macOS; detector alerts |
| Malware and intrusion detect | Host telemetry; limited network intrusion detection; email and Domain Name System at the edge |
| Containment | Playbook to host response and/or account disable and/or virtual LAN drop and/or session revoke |
| Segmentation | On-premises zone firewall |
| Email and Domain Name System hygiene | Edge email plus DNS-over-HTTPS plus the gateway forwarder |
| Risk acceptance | Governance, risk, and compliance register only |
Engagement
Assess, then wire, then stay.
Assess
Look at the floor
Identity, laptops, local network, cupboard, warehouse, Disaster Recovery as a Service. A half-day for a shop; longer if there is a second site.
Wire and quiet
Harden, then silence junk
Thirty days to enroll, segment, turn on DNS-over-HTTPS, pin remote support, and stop the mailbox-as-security-console habit.
Tabletop
Four drills, written
Phish, USB on a jump host, restore, leaked mailbox. Three books stay unmixed.
Retainer
24/7 triage
On-call with a cap on junk pages. Pre-authorized contain. Evidence the register can pull.
Guarantee
The pattern, in writing.
Same control pattern a larger firm uses: identity, devices, segmented floor, watched alerts, three books of record, a tested restore. Support is a named on-call with published acknowledge times and a cap on junk pages. What we cannot close is written as an exception, not hoped away.
Coverage
First visit is local. After that, remote.
For clients who need traditional managed-service onboarding or an audit walkthrough. First visit is on site. After that the work is remote. Extra sites or a return visit are scoped, not assumed.
- Arthur
- Atwood
- Auburn
- Ayton
- Bayfield
- Belgrave
- Belmore
- Bluevale
- Blyth
- Brussels
- Clifford
- Clinton
- Drayton
- Dublin
- Durham
- Ethel
- Fordwich
- Formosa
- Goderich
- Gorrie
- Gowanstown
- Hanover
- Harriston
- Hensall
- Holmesville
- Kincardine
- Lakelet
- Listowel
- Lucknow
- Mildmay
- Milverton
- Mitchell
- Molesworth
- Monkton
- Moorefield
- Mount Forest
- Neustadt
- Newry
- Paisley
- Palmerston
- Priceville
- Ripley
- Seaforth
- Stratford
- Teeswater
- Tiverton
- Vanastra
- Walkerton
- Walton
- Wingham
Book
Request an assessment.
Twenty minutes. Named situation, recommended next step, first three actions. We reply with a calendar slot.