Cybersecurity & GRC
Cybersecurity services that protect your business, your data and your clients
We help organisations find their security gaps, fix what matters most and meet their governance, risk and compliance obligations, with practical advice in plain language and support when you need it.
The risk
Most breaches start with everyday gaps
Attackers rarely need anything sophisticated. They look for the simple weaknesses most organisations have.
- Phishing emails and fake invoices that trick staff into paying or sharing passwords
- Weak or reused passwords, with no multi-factor authentication
- Unpatched servers, websites and devices with known vulnerabilities
- Backups that have never been tested, leaving you exposed to ransomware
- Former staff and suppliers who still have access to systems
- Personal information handled without the controls POPIA requires
Signs it is time for a security review
- You are not sure who has access to which systems
- A client, insurer or auditor has asked about your security
- You have had a suspicious email, payment or login
- You store customer, employee or financial data
Our services
How we protect your business
Choose a single service or combine them into a security programme that fits your size, sector and budget.
Security assessment & risk review
A structured review of your systems, access, policies and data, with a clear report that ranks risks by business impact.
Vulnerability management
Scanning and testing of your websites, servers and networks to find weaknesses before attackers do, followed by fixes.
Cloud, email & access security
Hardening of Microsoft 365, Google Workspace and cloud accounts, multi-factor authentication and access controls.
Secure software & application review
As software developers, we review your web and mobile applications for security flaws and help your team fix them.
Backup, recovery & incident response
Tested backups, a disaster recovery plan and hands-on support to contain, recover from and learn from an incident.
POPIA compliance & staff awareness
Data protection policies, practical POPIA readiness and awareness sessions that teach staff to recognise threats.
Governance, risk & compliance
Security your board, auditors and clients can trust
Technology controls are only half of security. We help you put in place the governance, risk management and compliance structures that regulators, auditors, insurers and large clients now expect, and make security part of how your organisation is run.
Security governance
Information security policies, roles and an information security management system (ISMS) aligned to ISO/IEC 27001, with reporting your board can use.
Risk management
Cyber risk assessments, a living risk register, third-party and supplier risk reviews, and treatment plans tied to business impact.
Compliance
Practical readiness for POPIA, King IV IT governance principles, PCI DSS for card payments and GDPR for European clients.
Audit readiness
Preparation for internal, external and regulatory IT audits, including evidence packs and fixing audit findings.
Business continuity
Business impact analysis, continuity and disaster recovery plans, and tabletop exercises so your team knows what to do.
Virtual CISO
A senior security leader on retainer to own your security programme, advise management and report to the board.
Our approach
A security programme in six steps
We start with what you have, fix the biggest risks first and keep improving, so security grows with your business.
Discover & assess
We map your systems, data, users and suppliers, and review how they are protected today.
Report & prioritise
You receive a plain-language report with risks ranked by impact and a costed action plan.
Harden & protect
We close the gaps: access controls, patching, MFA, secure configuration and encryption.
Train your people
Staff learn to spot phishing and handle data safely, the first line of defence.
Monitor & maintain
Ongoing updates, checks and reviews keep your protection current as threats change.
Respond & recover
If something happens, we help you contain it, restore operations and prevent a repeat.
Ways to work with us
Engagements that fit your business
Security assessment
A once-off review with a written report and prioritised recommendations.
Remediation project
We fix the issues identified, to an agreed scope and timeline.
Managed security
A monthly retainer covering monitoring, updates, reviews and support.
GRC programme & vCISO
Governance, risk and compliance run as a programme, led by a virtual CISO.
Security-first by design
Security is built into how we develop and host software, not added later.
Developers and security
We understand applications from the code up, so fixes are practical and lasting.
Local regulatory context
Practical POPIA guidance that fits the way African organisations work.
Plain language
Clear reports and advice your management team can act on.
Questions
Cybersecurity FAQs
We are a small business. Do we really need this?
Yes. Smaller businesses are often targeted because they have fewer protections. A short assessment shows where you are exposed and which affordable steps reduce most of the risk.
What does a security assessment involve?
Interviews with your team, a review of your systems, accounts, access and backups, and technical checks of your websites and devices. You receive a report with findings ranked by risk and a practical action plan.
Will it disrupt our operations?
No. Assessments are planned with you, and any testing or changes that could affect systems are scheduled at agreed times.
Can you help us with POPIA?
Yes. We help you understand what personal information you hold, put the right security controls and policies in place, and prepare staff to handle data correctly.
Can you get us ISO/IEC 27001 certified?
We prepare you for certification: scoping, gap analysis, policies, risk assessment, controls and internal audit. The certificate itself is issued by an independent, accredited certification body, and we support you through that audit.
What is GRC and do we need it?
Governance, risk and compliance is how security is managed at leadership level: who is accountable, which risks matter most, and how you prove you meet laws and client requirements. If you answer to a board, regulator, auditor or large clients, a GRC programme makes those conversations far easier.
What if we have already been breached?
Contact us immediately. We help you contain the incident, restore systems from clean backups, and close the gap that allowed it.
Book a cybersecurity consultation
Tell us about your organisation and your concerns. A consultant will respond within one business day.
Urgent security issue?
If you suspect a breach, call or WhatsApp us directly so we can help you contain it quickly.
Confidential by default
Everything you share about your systems and any incident is treated as strictly confidential.