Cybersecurity
The full domain, and the other capabilities within it.
Endpoint Security & XDR
Detect and contain what reaches the endpoint, and see it alongside everything else.
What this is
Endpoint detection and response puts a sensor on the device and gives you the ability to see process behaviour, not just files. Extended detection and response (XDR) joins that endpoint telemetry to identity, email and network signal, so a single alert carries the context needed to judge it.
The tools are mature; the failures are almost never the sensor. They are coverage gaps, detections left at vendor defaults, and nobody owning what happens between an alert firing and a machine being isolated. That is where this work concentrates.
When you need it
If more than one of these is true, this is usually the right place to start.
- Antivirus that reports clean while incidents are still being found by users noticing something is wrong.
- An EDR product already bought and partly deployed, with servers or legacy systems still uncovered.
- Alert volume high enough that the team has quietly started ignoring whole categories.
- No agreed answer to who may isolate a production machine at three in the morning, and on what authority.
What the scope covers
- Coverage assessment: every operating system, server, virtual desktop and unmanaged device, with the gaps named rather than rounded away.
- Deployment and hardening: agent rollout, tamper protection, exclusions reviewed rather than inherited.
- Detection engineering: tuning to your estate, suppressing the noise your own software generates, and writing the detections your risks call for.
- Response playbooks: what is automated, what needs a human, and who that human is at each hour of the day.
- Integration into SIEM and identity, so an endpoint alert can be read next to the sign-in that preceded it.
What you receive
| Deliverable | What it contains |
|---|---|
| Coverage baseline | Inventory against deployed agents, with every uncovered system listed and a reason: not yet, cannot, or will not. |
| Tuned detection set | Detections mapped to MITRE ATT&CK technique, each with a stated intent and the noise it was tuned against. |
| Response playbooks | Per scenario: containment action, authority to act, notification path, and the evidence to preserve before acting. |
| Handover pack | Runbooks, escalation matrix, and a walkthrough with the team who will hold it after we leave. |
Reference architecture
A reference, not a template. Your estate decides which parts apply and in what order they arrive.
How success is measured
Targets are agreed with you before the work starts, and reported against for its duration.
- Agent coverage as a percentage of known assets, and the trend of the uncovered list.
- Alert-to-triage ratio: how many alerts a person actually has to read per day.
- Mean time to contain for the scenarios the playbooks cover, measured in exercises before it is measured in incidents.
Questions we are asked
We already have antivirus. Is EDR different?
Yes, materially. Signature antivirus asks whether a file is known to be bad. EDR records process behaviour, parent-child relationships and network calls, so it can flag a chain of individually legitimate actions. It also lets you go back and answer what happened, which antivirus cannot.
Will the agent slow our machines down?
Modern agents are light, but exclusions and scan policy decide the outcome, and inherited exclusions are a common source of both slowness and blind spots. We measure impact on a representative sample before a wide rollout rather than after complaints.
What does XDR add over EDR?
Correlation. An impossible-travel sign-in is weak on its own and so is a suspicious script, but together on the same identity within ten minutes they are a strong signal. XDR is the plumbing that lets a detection be written across those sources.
Should containment be automatic?
For some scenarios, yes — a confirmed ransomware pattern should not wait for a phone call. For others, automatic isolation of a production system causes the outage the attacker wanted. The playbook decides per scenario, and you approve that split before it goes live.
Do we need a SOC for this to be useful?
You need someone to act on what it finds. That can be your team with playbooks, or a managed service. What does not work is deploying the tool and treating the console as something to check when there is time.
Can you tune a deployment we already have?
Often that is the higher-value engagement. An existing deployment already has the coverage data and the noise history, so tuning starts from evidence rather than assumption.
Continue reading
Cloud Security
Posture management, workload protection and entitlement control for AWS, Azure and GCP — with misconfiguration caught in the pipeline, not in production.
Identity & Access Management
Single sign-on, multi-factor authentication, privileged access and joiner-mover-leaver — built so access is granted deliberately and removed automatically.
Start with an assessment
The fastest way to a useful answer is a short, scoped look at what you already have.