Cybersecurity, without the doom marketing.

What our standard security stack includes

This is what we deploy for every Managed IT customer by default. None of it is optional. None of it is upcharged separately. It's the floor, not the ceiling.

Endpoint protection (EDR)

Modern endpoint detection and response — not the legacy antivirus your last MSP installed. EDR watches what software is doing, not just what files exist, and stops behaviors that look like attacks even when the malware is brand-new. Centrally managed, alerts come to us, we triage and respond.

Email filtering

Email is still the #1 way attackers get in. We layer business-grade email filtering in front of your inbox — catching spam, phishing, malware attachments, and business email compromise (BEC) attempts where someone impersonates your CEO to redirect a wire transfer.

Multi-factor authentication (MFA)

MFA on every account that supports it. Microsoft 365, your VPN, your line-of-business apps. Cyber insurance requires it. Compliance frameworks require it. And it stops the vast majority of credential-theft attacks cold.

DNS filtering

When a user clicks a malicious link, DNS filtering blocks the connection before their browser ever reaches the bad site. Stops phishing landing pages, malware downloads, and command-and-control traffic. Invisible to the user when it works (and when it blocks something, they get a useful "this was blocked because..." page).

Dark web monitoring

We monitor for your domain and employee credentials appearing in known credential dumps. When something shows up, we get alerted, force a password change, and check for any sign that the account was actually used.

Security awareness training

Short monthly videos for users, plus simulated phishing emails to measure who's clicking what. The goal isn't to shame users — it's to give them practice spotting real-looking attacks in a safe environment. Compliance frameworks love this. Insurance underwriters love this. And it actually works.

Patch management

Most breaches exploit vulnerabilities that already have patches available. We patch operating systems, browsers, and common third-party apps (Java, Adobe, Zoom, Chrome, etc.) on a managed schedule with reporting.

Optional layers we add when the risk profile calls for it

SIEM and log monitoring

For customers with compliance requirements or higher risk profiles, we deploy centralized logging and a managed SIEM (security information and event management) so security events from across the environment can be correlated and investigated.

Vulnerability scanning

Scheduled internal and external scans that identify weaknesses before attackers do. Quarterly is standard; some customers run monthly.

Penetration testing coordination

For customers who need a real pen test (often required by larger customers or insurance), we coordinate with reputable third-party testing firms and help remediate findings.

Compliance frameworks

We implement the technical controls required by HIPAA, PCI-DSS, CMMC, NIST 800-171, and SOC 2. We don't write your compliance program — that's a job for an auditor or compliance consultant — but we make the technical side actually happen.

Ransomware — the threat we plan around

Ransomware is the #1 reason CT businesses call us in a panic. Prevention has three parts:

1. Make it hard to get in — the security stack above.
2. Make it hard to spread — network segmentation, least-privilege access, blocking lateral movement.
3. Make recovery cheap — immutable backups that ransomware can't encrypt. See Backup & BCDR.

That third part is the difference between "we lost a few hours of work" and "we paid the ransom." We use Datto for backups specifically because the snapshots are immutable — they can't be encrypted or deleted by anything on your network, including ransomware.

How we approach a new security engagement

1. Assessment. We look at your current security posture — what's deployed, what's not, where the gaps are. Findings are scored by risk so you can prioritize.
2. Prioritized roadmap. Not everything needs to happen tomorrow. We sequence remediation by risk and budget impact.
3. Implementation. Deploy the missing controls, integrate them with your existing tools, document them.
4. Ongoing monitoring. Alerts come to us. We triage. You hear about it when there's something you need to know.
5. Quarterly reviews. What changed in the threat landscape, what we caught and stopped, what to invest in next.

Cyber insurance — what we help with

Cyber insurance underwriters now require specific technical controls to write a policy. We help our customers complete insurance questionnaires accurately (lying on these voids your policy when you need it), implement missing required controls, and provide attestation letters when needed.

Common requirements we implement: MFA on email and remote access, EDR (not just antivirus), email filtering, immutable backups, documented incident response plan, regular security awareness training.