Engagements · Operating since 2002
Nobody calls a security company in the abstract. They call because one specific thing has gone wrong, or is about to, or because somebody has asked a question they cannot currently answer.
These are the six situations that account for most of that. For each one: what it tends to look like from the inside, what we usually find, what the work actually involves, and how it is priced.
Find yourself on this
Six situations, mapped by urgency and reach
Most people arrive already inside one of these, and knowing which changes what should happen first.
The positions are our judgement rather than measurements, and the diagram says so. The useful thing is the top-right corner: when something has to move in hours and touches everything, the ordinary procurement process is the wrong instrument and you should call instead of reading.
In detail
What each one actually involves
Described generically. None of this is a specific client, and where a figure could not be stated honestly it is not stated.
A live ransomware incident
Files are encrypted, somebody has found the note, and the first instinct in the room is to restore from backup and get people working.
What we usually find. Almost always that the way in was a credential or an unpatched edge device rather than the machine that got encrypted — which is why restoring the machine alone returns you to the same position within days. Frequently a service account with a password set years ago and never rotated.
What the work is. Contain first, establish scope second, restore third. Somebody has to be willing to say a system stays offline while that happens, and that sentence is the whole job. Then eviction, then recovery, then the boring work of closing the path.
A compliance deadline found late
An auditor, a customer security questionnaire, or a tender has asked for evidence that controls exist and are operating — and the controls mostly do exist.
What we usually find. That the controls are usually fine and the record of them is not. Change history, exception approvals and access reviews were done informally and never written down, so a year has to be reconstructed from memory and email. Reconstruction is the task that quietly does not happen.
What the work is. Establish what the framework actually requires, work out what evidence already exists in the tooling, close the genuine control gaps, and switch the recording on so next year is not another reconstruction.
A SOC that was bought and never tuned
A SIEM or an MDR service is in place, it produces a great many alerts, and nobody has looked at the console properly in months. Often bought for a compliance requirement and never operationalised.
What we usually find. Detection content left at vendor defaults, log sources that were connected once and have silently stopped, and an alert volume that trained everyone to ignore the queue. Coverage gaps are usually in identity and cloud rather than endpoints.
What the work is. Audit what is genuinely being collected against what everyone believes is being collected — those two lists differ more than anyone expects. Then tune for the estate, retire the noise, and agree what actually warrants waking someone.
A migration that must not break anything
A data centre move, a cloud migration, or a firewall replacement, where the business tolerance for disruption is approximately zero and the change window is a weekend.
What we usually find. That the current state is not documented as well as everyone believes. Firewall rule bases in particular carry permit rules for systems decommissioned years ago, and nobody remembers which are load-bearing.
What the work is. Discovery and dependency mapping first, because the unknown rules are the risk. Then a staged cutover with a rollback that has actually been tested rather than merely written down.
A branch that keeps dropping
One location has intermittent problems. It has been escalated to the ISP more than once, who report no fault, and the users have stopped raising tickets because nothing came of the last four.
What we usually find. Very often not the circuit. Duplex mismatches, a failing SFP, an overloaded uplink at a specific time of day, or wireless contention that only appears when the site is full. Intermittent faults survive precisely because nobody is watching at the moment they occur.
What the work is. Instrument first so the fault is observed rather than described second-hand, then fix what the data shows. This is also the category where a fault and an intrusion look identical for the first twenty minutes.
Firewall rules nobody has reviewed
Nothing is wrong. The estate works. But the rule base has grown for five or more years through accumulated emergency changes and no one has removed anything, because removing a rule is how you cause an outage.
What we usually find. Permit rules for decommissioned systems, any-any rules added during an incident and never revisited, and duplicate objects with slightly different names. Each stale permit is a path that exists for no current reason.
What the work is. Review against what the estate actually is now, retire what is genuinely dead, and put a recurring review in place — because a one-off cleanup regrows within two years without one.
Side by side
The same six, compared
Including how each is metered, because that is the question that follows immediately after “is this us?”
Scroll the table sideways →
| Situation | How it looks | What we find | The work | How it is priced | Detail |
|---|---|---|---|---|---|
| A live ransomware incidentHours · touches everything | Files are encrypted, somebody has found the note, and the first instinct in the room is to restore from backup and get people working. | Almost always that the way in was a credential or an unpatched edge device rather than the machine that got encrypted — which is why restoring the machine alone returns you to the same position within days. Frequently a service account with a password set years ago and never rotated. | Contain first, establish scope second, restore third. Somebody has to be willing to say a system stays offline while that happens, and that sentence is the whole job. Then eviction, then recovery, then the boring work of closing the path. | Incident response is scoped as an engagement, not a subscription. If you are in this today, call rather than read. | Detection and response |
| A compliance deadline found lateWeeks · broad evidence gap | An auditor, a customer security questionnaire, or a tender has asked for evidence that controls exist and are operating — and the controls mostly do exist. | That the controls are usually fine and the record of them is not. Change history, exception approvals and access reviews were done informally and never written down, so a year has to be reconstructed from memory and email. Reconstruction is the task that quietly does not happen. | Establish what the framework actually requires, work out what evidence already exists in the tooling, close the genuine control gaps, and switch the recording on so next year is not another reconstruction. | Scoped per framework and estate size. The recurring part is much cheaper than the first pass, which is the argument for not leaving it until next time. | Compliance services |
| A SOC that was bought and never tunedWeeks · alerts nobody reads | A SIEM or an MDR service is in place, it produces a great many alerts, and nobody has looked at the console properly in months. Often bought for a compliance requirement and never operationalised. | Detection content left at vendor defaults, log sources that were connected once and have silently stopped, and an alert volume that trained everyone to ignore the queue. Coverage gaps are usually in identity and cloud rather than endpoints. | Audit what is genuinely being collected against what everyone believes is being collected — those two lists differ more than anyone expects. Then tune for the estate, retire the noise, and agree what actually warrants waking someone. | Metered on log sources or ingest volume. Retention length is the single biggest lever on the number. | Managed SIEM |
| A migration that must not break anythingPlanned · touches everything | A data centre move, a cloud migration, or a firewall replacement, where the business tolerance for disruption is approximately zero and the change window is a weekend. | That the current state is not documented as well as everyone believes. Firewall rule bases in particular carry permit rules for systems decommissioned years ago, and nobody remembers which are load-bearing. | Discovery and dependency mapping first, because the unknown rules are the risk. Then a staged cutover with a rollback that has actually been tested rather than merely written down. | Project-scoped. The discovery phase is the part buyers try to cut and the part that determines whether the weekend goes well. | Infrastructure security |
| A branch that keeps droppingDays · one site at a time | One location has intermittent problems. It has been escalated to the ISP more than once, who report no fault, and the users have stopped raising tickets because nothing came of the last four. | Very often not the circuit. Duplex mismatches, a failing SFP, an overloaded uplink at a specific time of day, or wireless contention that only appears when the site is full. Intermittent faults survive precisely because nobody is watching at the moment they occur. | Instrument first so the fault is observed rather than described second-hand, then fix what the data shows. This is also the category where a fault and an intrusion look identical for the first twenty minutes. | Metered per monitored device or interface. Settle what counts as a device before comparing quotes. | NOC as a Service |
| Firewall rules nobody has reviewedMonths · quietly accumulating | Nothing is wrong. The estate works. But the rule base has grown for five or more years through accumulated emergency changes and no one has removed anything, because removing a rule is how you cause an outage. | Permit rules for decommissioned systems, any-any rules added during an incident and never revisited, and duplicate objects with slightly different names. Each stale permit is a path that exists for no current reason. | Review against what the estate actually is now, retire what is genuinely dead, and put a recurring review in place — because a one-off cleanup regrows within two years without one. | Scoped per firewall pair and rule count. Unglamorous, cheap relative to its effect, and consistently deferred. | Firewall services |
Two patterns run through all six. The discovery phase is consistently the part buyers try to compress and consistently the part that decides whether the rest goes well. And in four of the six, what everyone believes is being collected and what is genuinely being collected turn out to be different lists.
Questions we get asked
Engagements, answered
Why are there no named case studies on this page?
Because we do not have permission to publish client names, figures and engagement specifics, and writing them without that permission would be a poor advertisement for a firm selling confidentiality. This page used to promise real-world success stories and then show a product catalogue, which is worse than admitting the gap. What we offer instead is a scheduled reference call with a client running a comparable estate — harder for us to arrange than a written page, and considerably more useful to you.
How do I get a reference call?
Ask, and tell us your sector and rough estate size so the client we introduce you to is genuinely comparable. We schedule it rather than putting anyone on the spot, because our clients are doing us a favour. Details on client feedback.
Are these six situations made up?
They are the recurring patterns behind the work, described generically. Nothing on this page describes a specific client, and the positions on the diagram are our judgement rather than measurements — the page says so on the diagram itself. If a figure could not be stated honestly, it is not stated.
We are in the middle of an incident right now. What should we do?
Call rather than read. The one thing worth knowing before you speak to anyone: resist rebuilding the affected machine until somebody has established how the attacker got in. Restoring from backup meets the instinct to fix it and destroys the evidence, and if the way in was a credential rather than the machine, the same intrusion returns within days.
How long does a typical engagement take?
It varies by situation, which is why the diagram plots urgency rather than a schedule. Incidents move in hours, assessments in weeks, managed services are continuous. What is common to all of them is that the discovery phase is the part buyers try to compress and the part that determines whether the rest goes well.
How is each of these priced?
Differently, and the meter matters more than the rate. Monitoring is metered on log sources or ingest volume, network operations per monitored device, assessments per scope in tester-days, and incident response as an engagement. The full breakdown, with published third-party benchmarks, is on pricing.
What if our situation is not one of these six?
Then describe it and we will say honestly whether it is something we do well. Several pages on this site argue against buying things — that business email compromise is a finance process problem, that a scanner-only programme is not application security, that SOAR improves nothing about detection. We would rather tell you that than scope work we cannot deliver against.
Do you publish the Fortinet product detail that used to be here?
Yes, on the pages built for it: Fortinet for the platform overview, and the FortiGate, FortiSwitch and FortiAP pages for the ranges. That material was not wrong — it was simply on a URL that promised something else entirely.
Next step
Tell us which one you are in
If it is the top-right corner of that diagram, call rather than write. For anything else, a description of the situation is a better starting point than a requirements document — requirements tend to encode a solution somebody has already chosen, and the situation is what we can actually advise on.