Shielding, identity, and governance
Protect identities, devices, and data with controls proportionate to your business, clear priorities, and structured follow-up.
Risk in context
Security starts by understanding exposure, impact, and operational capacity—without alarmism or absolute promises.
Practice areas
Practice areas are combined according to the diagnostic, available licensing, and approved scope.
Weak credentials, excessive privileges, and inconsistent joiner and leaver processes.
MFA, access review, administrative profiles, conditional policies, and procedures. Microsoft Entra may be used when relevant and licensed.
Phishing, inappropriate sharing, and weak email and file settings.
Policy review, email protection, sharing rules, and Microsoft 365 or Google Workspace configuration according to engagement and licensing.
Devices without a protection, encryption, update, or centralized management baseline.
Device policies, encryption, protection, and management with technologies such as Defender and Intune when applicable.
Flat networks, exposed access, unreviewed rules, and inconsistent cloud configurations.
Segmentation, rule review, VPN, hardening, and firewall or cloud controls; FortiGate may be part of the solution when relevant.
Data without clear classification, ownership, access, or retention rules.
In-scope inventory, classification, access matrix, retention, and technical controls. Purview may support licensed Microsoft scenarios. Technical work does not replace legal advice for data protection laws.
Exposure understood only partially or not yet validated.
Authorized scope, technical assessment, evidence, classification, and recommendations. Penetration testing includes controlled manual testing when contracted; automated scanning is not penetration testing.
Missing roles, contacts, procedures, and proven recovery capability.
Plans, escalation flows, exercises, backup review, and recovery tests according to scope.
Rules that are unknown or risky behavior without practical guidance.
Policies, procedures, guidance materials, and awareness actions suited to the contracted audience.
MaaS® Method
Execution focuses on Shielding & Identity and Orchestration & Governance, connecting Structural Foundation and Business Continuity when risk requires it.
Diagnostic
Prioritization
Control implementation
Validation
Follow-up and evolution
Primary layer for identities, endpoints, collaboration, and access.
Policies, risk, evidence, indicators, and executive priorities.
Applies when network, cloud, or architecture supports the control.
Integrates recovery, readiness, and resilience into relevant scenarios.
Deliverables and evidence
Deliverables are selected according to scope, environment, and agreed responsibilities.
There is no absolute security. The goal is to reduce risk proportionately, increase visibility, and prepare decisions and responses.
Engagement models
Assessment, implementation, or improvement with a defined start, end, scope, and delivery criteria.
ProjectsMonitoring, control maintenance, indicators, and evolution according to the contract, responsibilities, and SLA.
Optional continuityAutomated monitoring detects events and generates alerts. Human analysis and response depend on the service, coverage, and SLA actually contracted.
Frequently asked questions
No. An assessment identifies and analyzes vulnerabilities. A penetration test adds controlled manual techniques to validate exploitation within a formally authorized scope.
We do not promise complete legal compliance. We can provide technical support for data protection and control implementation; legal decisions require qualified counsel.
Only when coverage, channels, and SLA are expressly contracted. Automated monitoring, alert generation, and human response are distinct capabilities.
Not necessarily. The diagnostic considers risks, architecture, licensing, and existing tools before recommending changes.
Yes. A practice area can be engaged as a one-off project when its dependencies and boundaries are clear in the scope.
A structured assessment turns technical exposure into clear priorities, controls, and next steps.
