How we work
How we work,
and why.
The detail behind the homepage. Why patching a few days after a flaw is published is too late, how we watch for an attack and answer it, the discipline we bring from plants, how we set the balance with you, and how much of the work you hand over.
The clock has changed
Exploited flaws have been the most common way into a company for six years running. What changed is how fast a published flaw turns into an attack, and how long an attacker stays once inside.
Mapped before the flaw is public
Scanners record which software and versions answer where, all the time. When a flaw is published, the targets are already on a list, and the first attempts can come within minutes, often before a patch exists.
Patching covers only one way in
Attackers also come in with stolen passwords, through services nobody meant to expose, and through flaws with no fix yet. Each needs its own layer.
Once inside, they stay
Intruders add accounts, move to more machines and wait for the moment that pays most. Ransomware gives itself away within days; quieter intruders have stayed for months at a telecom supplier, more than a year at a security vendor, and at least five years in some networks. The longer nobody notices, the larger the bill.
Patching a few days after you hear about it is a plan. It just doesn’t have a happy ending.
So updates are one part of the work. We also watch for the attack itself, and answer it.
Sources: Mandiant (Google Threat Intelligence), M-Trends 2026, published 23 March 2026 (2025: estimated mean time to exploit of −7 days; exploits the first way in for 32% of intrusions), and Mandiant’s time-to-exploit analyses for 2018 to 2023; VulnCheck, State of Exploitation 2026 (28.96% exploited on or before publication day); CISA advisory AA24-038A (Volt Typhoon inside some networks for at least five years); F5’s disclosure of October 2025 (long-term access, reported as more than a year) and Ribbon Communications’ filing (about nine months); H2’s own logs for CVE-2026-98432.
We watch for the attack, and answer it
Attacks also come before a patch exists, or through a door nobody knew was open. EDR on your servers and a SIEM over your logs look for three kinds of sign, and each has an answer ready.
Each sign has an answer that runs on its own, and a person who hears about it. Which answers run automatically and which wait for your team is agreed for each system before anything is switched on.
EDR watches what happens on each machine; a SIEM puts the logs from all of them side by side, so a pattern that no single machine shows still stands out.
Someone is looking
Scans and probes mapping your services and versions; repeated knocks on login pages and admin paths.
The source is blocked. What they could see is reviewed and, where possible, closed or hidden.
Someone is trying
Exploit attempts against the versions you run, password spraying, attempts on services known to be weak.
Blocked automatically. The system they aimed at is checked, and the person on call is alerted.
Someone got in
New accounts, unexpected processes or services, movement between machines, data leaving by any path at odd hours.
The host is isolated, the access involved is cut, and incident response starts with your team.
Every alert, decision and action is recorded, so you can show what happened and what was done about it.
OT rigour, applied to IT
Plants learned long ago to run control networks with discipline. Office and data-centre networks now carry the same kind of risk, so we bring the same discipline, set to what each system needs.
Every device known and owned
Nothing running that nobody can name. When a new device or connection appears, someone hears about it.
Every change planned, recorded and reversible
Updates follow a plan, with a window, a check afterwards and a way back.
Zones that hold
A compromised device is kept away from your servers, and the guest network away from production.
Availability first
Changes are scheduled around your operations, the way a plant schedules around production.
Only what is needed runs
Services, connections and radios are allowed by list, including where devices may send their updates and data; everything else stays closed.
Every gain in security costs something
We set the balance together. Stricter means more steps for your people, slower changes and more cost. Looser means more risk. We agree the setting for each kind of system, write it down, and revisit it when the business or the threats change.
Example
Production and payments
- Protection
- Ease of use
- Cost
- Speed of change
Passkeys everywhere, changes in agreed windows with a second person approving, every alert answered.
Example
Office systems
- Protection
- Ease of use
- Cost
- Speed of change
Single sign-on, monthly updates, devices listed and kept in their own zone.
Example
Test and lab
- Protection
- Ease of use
- Cost
- Speed of change
Kept apart from production, rebuilt often, watched for anything that tries to cross over.
Speed of deployment, availability, the skills your team has: there are more settings than these four, and each one is a choice we make together.
As much or as little as you want us to carry
Each of the four parts can be ours, shared, or your team’s with our tools. You decide the split, and you can change it as your team grows.
Fully managed
We run it
We find, fix, watch and answer, and send you the record. Your team approves the changes that matter to the business.
Co-managed
We share it
You pick the parts. For example, we watch and answer while your team does the updates, or the other way round. One record covers both.
Your tools, your team
Your team runs it
We install the tools on your infrastructure, train your people to use them, and stay on call for the hard cases. Everything runs on your side, air-gapped if needed, with nothing reaching us.
Training comes with every engagement: your people learn the tools, the checks and the response playbooks on your own systems, so the knowledge stays with you.
Where the usual tools fall short, we build what is missing
Off-the-shelf tooling covers the common case and leaves gaps: data kept in separate places, alerts that reach no one, steps done by hand. Accepting that things are “usually done this way” is the proven way to waste time and become vulnerable. We bend the tools to how you work.
Pinpoint
Find where it slips
We trace where time goes and where things get missed: the manual step, the alert nobody owns, the system no tool can see.
Build or adapt
Close the gap
We extend the tools you have, or write the missing piece: small, documented, and yours to keep.
Integrate
Connect it to what you run
It works with your monitoring, ticketing, identity and chat, so the work moves between systems without anyone copying it by hand.
The tools we build and run ourselves started the same way. See them →
The non-negotiables
Your data stays yours
No dependency dressed up as convenience.
On your infrastructure
Your servers or your chosen cloud, movable any time.
A person decides
The machine proposes; people have the final word.
Nothing phones home
What runs on your machine reports to you alone.
European
European engineers and law, clients anywhere.
Start with a free inventory
Most of the work starts with knowing what runs. We read it from your systems with your permission, then give you a 45-minute readout with one real finding and a straight answer on whether you need us.
- FreeInventory. What runs on your systems and what is exposed, read on the dates you agree. You keep the results.
- €9,500Assessment. Priorities, risks, a plan and a quote, for a fixed fee, excluding VAT, credited against the work that follows.
- MonthlyOngoing protection. From €2,400 a month: we apply your updates, watch your systems, record every action and send a short report each month. The three plans.