Services

Each service can be taken on its own or combined. They all start the same way: an assessment of the real state of things, with no changes and no risk, so decisions are made on data rather than intuition.

Detailed scope

Linux server hardening

Who it is for: VPS, dedicated servers and virtual machines running Debian, Ubuntu, RHEL or derivatives.

What it includes

Surface reduction: unnecessary services out, ports closed by default
Hardened SSH: key-only, no root, attempt and session limits
Firewall and fail2ban with per-profile rules, not a copied recipe
Kernel and sysctl tuning according to the server role
Automatic, controlled security updates
Read-only audit with a before-and-after report

Deliverables: Idempotent, versioned script, configuration in your repository, evidence report.
Timeframe: 1 to 3 days per server; 1 to 2 weeks for a full fleet.

Cloud security

Who it is for: AWS and Oracle Cloud accounts, from free tier to multi-service environments.

What it includes

Identity and permission review: least privilege, no long-lived keys
Network design: subnets, security groups, bastion and admin access paths
Disk, backup and storage encryption; secret rotation
Account activity logging and monitoring
Cost review: shut down what is unused, resize what is oversized
Architecture documentation as it was actually left

Deliverables: Architecture diagram, applied policies and a verification checklist.
Timeframe: 3 to 5 days for an account with one service in production.

DevSecOps and secure CI/CD

Who it is for: Teams that deploy often and need security without slowing down.

What it includes

Secret detection across history and every new change
Dependency and container image scanning with a severity policy
Infrastructure-as-code review before apply
Gate that blocks the deployment on a critical or high vulnerability
Minimal, non-root containers with the version pinned by digest
Results reported inside the pull request itself

Deliverables: Versioned pipeline and reusable template, tested red and green.
Timeframe: 1 to 2 weeks depending on the number of repositories.

Vulnerability management

Who it is for: Companies that need to know what they own, what matters and what is being done.

What it includes

Asset inventory and internet-exposed surface
Authenticated and unauthenticated scanning by asset type
Prioritisation by exposure, exploitability and asset criticality
Agreed remediation SLAs and tracking through to closure
Executive reporting for leadership, technical detail for the team

Deliverables: Inventory, remediation plan with deadlines and a tracking dashboard.
Timeframe: Two-week initial cycle, then monthly cycles.

Monitoring and response

Who it is for: Organisations that would rather hear about an incident from an alert than from a customer.

What it includes

Log centralisation with retention and verifiable integrity
Detection rules tuned to the real environment, to cut the noise
Alerts with enough context to act without investigating from scratch
Written and tested incident runbooks
Tabletop exercise with your team

Deliverables: Detection rules, runbooks and a training session with the team.
Timeframe: 2 to 4 weeks depending on the number of log sources.

Continuity and recovery

Who it is for: Companies that cannot afford to discover their backup was useless.

What it includes

3-2-1 strategy with an off-site, encrypted copy
Backup automation and integrity verification
Timed restore test on real infrastructure
RTO and RPO defined together with your team
Step-by-step recovery procedure, tested and in your hands

Deliverables: Continuity plan, backup automation and a signed record of the restore test.
Timeframe: 1 to 2 weeks depending on data volume.

Not sure where to start?

We start with the assessment. Within days you have the real state of your infrastructure, prioritised by risk, with the cost and timeline of each stage in writing.

Request an assessment