Representative engagements

How engagements run, sector by sector

Six situations we are brought in for, what we do in each, and what you can measure afterwards. These are composite engagements drawn from the kind of work we do, with no single client's details and no invented figures. Named references in your sector are arranged with the client's permission.

Legal

Ransomware on a Friday night at a law firm

The situation

A paralegal's workstation begins encrypting shared folders after hours. The firm learns of it when a partner cannot open a file on Saturday morning. Client files, trust-account records and court deadlines all live on the same server.

What we do
  • Endpoint detection isolates the workstation automatically; the SOC confirms the behaviour and pages the on-call engineer
  • Shared folders rolled back from snapshots; anything unrecoverable restored from the immutable off-site copy, with every restore timed
  • Entry point traced to a phished password on a mailbox without MFA; MFA enforced firm-wide, legacy authentication blocked, credentials rotated
  • Incident report with a timeline, evidence preserved for the insurer, and the regulator-notification decision documented with the partners
15 minFrom SOC confirmation to an engineer on the incident
Open for business on Monday, with the entry point closed, not just the symptom
Services involved
Healthcare

A clinic group that has to prove privacy, not promise it

The situation

Several clinics share one electronic medical record. A health-authority partner asks for evidence of PIPA compliance, and every minute the record system is down is a waiting room full of patients.

What we do
  • Gap assessment against PIPA and the partner's security schedule, written as a findings list with owners and dates
  • MFA, disk encryption and audit logging on every device that touches patient data; medical devices moved to their own network segment
  • Documented policies and a quarterly evidence pack the clinic's privacy officer can hand over without a scramble
  • Record-system availability monitored from outside; on-site response under four hours at every site
QuarterlyEvidence pack delivered to the privacy officer
Audit requests answered from a folder, not a fire drill
Services involved
Manufacturing

Production equipment on the same network as the office

The situation

Controllers and operator screens share a flat network with office PCs, and an equipment vendor holds a VPN account that is always on. A phishing click in accounting could reach the production line.

What we do
  • Asset discovery across IT and operational technology, including the devices nobody had on a list
  • Segmentation into production, office, management and vendor zones, with firewall rules written per flow and reviewed quarterly
  • Vendor remote access replaced with brokered, time-limited sessions that are approved and recorded
  • Monitoring for operational-technology protocols fed to the SOC; change windows aligned to production shifts
0Standing third-party connections into production
An office compromise can no longer reach the floor
Services involved
Technology

A SOC 2 report standing between a software company and its biggest deal

The situation

A growing software company is told an enterprise customer will not sign without a SOC 2 Type II report. There is no security lead, no written policy set, and the observation period has not started.

What we do
  • A fractional CISO owns the programme and reports to the founders weekly
  • Policies written to match how the company actually works, then the controls behind them: MFA, endpoint protection, logging, vendor review, change management, background checks
  • Evidence collection automated where the platforms allow it, so the observation period does not depend on anyone's memory
  • Auditor selection, readiness assessment and liaison through to the report
WeeklyEvidence review through the observation period
Controls designed, implemented and evidenced for the auditor
Services involved
Retail

Card payments across every store, to one standard

The situation

A retailer with many locations and point-of-sale terminals is working towards PCI DSS v4.0. Nobody can say precisely which systems touch card data, and each store's network was built differently.

What we do
  • Cardholder data environment scoped, then shrunk: segmentation and point-to-point encryption take most of the estate out of scope
  • One network standard deployed store by store, with the same firewall policy, wireless design and monitoring everywhere
  • Vulnerability scanning and patching on the published cadence; store staff trained on the handful of things that matter at the till
  • Evidence organised against the requirements so the assessment is a review, not an investigation
1Network standard across every store
Card data environment scoped, segmented and evidenced
Services involved
Public sector contractor

Security requirements attached to a government contract renewal

The situation

A contractor to the Government of Canada must demonstrate specific security controls to keep a contract. The requirements are precise, the deadline is fixed, and the internal IT team is two people.

What we do
  • Requirements mapped to the controls already in place and to the gaps, with a dated plan the contracting authority can read
  • Privileged access management, endpoint detection and response, and vulnerability remediation prioritised by exploitation in the wild
  • Documentation brought up to the standard: asset inventory, network diagrams, incident response plan, access reviews
  • Co-managed delivery, so the internal team keeps the keys and gains the depth
MonthlyRemediation tracked by exploited-in-the-wild status
An evidence package the contracting authority can accept
Services involved

Your situation, scoped properly

Tell us what you are facing. You will get a written proposal with what is included, what it costs and how it is measured, not a sales call that ends in a brochure.

Start the conversation →