Security engineering
Set up the defences that detect, block and contain attacks.
We design, deploy and harden the security controls your organisation depends on, configured for your environment and handed over with documentation your team can run with.
What we do
Eight ways we strengthen your defences.
Choose one area or combine several. Open any service to see what it covers and what you receive.
01 SIEM deployment & tuningCentralised logging and alerts your team can act on.
We connect your important log sources, write detection rules that match how your environment really works, and tune out the noise so genuine threats stand out instead of being buried in false alarms.
- Log source planning and onboarding
- Detection rules mapped to likely attack techniques
- Alert tuning to cut false positives
- Alert triage runbooks
You receive: a working SIEM, documented log sources and rules, and runbooks for responding to alerts.
02 EDR rollout & endpoint hardeningProtection and visibility on every laptop and server.
We plan and roll out endpoint detection and response across your devices, set policies that block common attacks without disrupting staff, and harden device configurations against secure baselines.
- Deployment plan and phased rollout
- Prevention and detection policy configuration
- Hardening against CIS Benchmarks
- Coverage checks for unmanaged devices
You receive: full endpoint coverage, a policy and hardening record, and a coverage report.
03 Firewall, VPN & network segmentationControl what can reach what, inside and out.
We design and configure firewall rules, remote access and network zones so that a compromise in one area cannot spread freely, while keeping legitimate business traffic flowing.
- Network zoning and segmentation design
- Firewall rule design and clean-up
- Secure VPN and remote access setup
- Administrative access restrictions
You receive: a segmented network, a documented rule base and a network diagram.
04 Email security & anti-phishingStop spoofing and malicious email before it reaches staff.
Email is still the most common way in. We configure your email platform and domain so attackers cannot impersonate you, and filter malicious messages before they reach inboxes.
- SPF, DKIM and DMARC through to enforcement
- Anti-phishing, anti-malware and attachment policies
- Impersonation and lookalike-domain protection
- User reporting of suspicious email
You receive: an enforced email authentication setup and documented protection policies.
05 Identity & access managementThe right access for the right people, and nothing more.
Most breaches involve stolen or misused accounts. We tighten how people sign in and what they can reach, starting with administrators and the systems that matter most.
- Multi-factor authentication rollout
- Privileged and admin account controls
- Role-based access design
- Joiner, mover and leaver process
You receive: stronger sign-in controls, an access model and a documented access review process.
06 Server & cloud hardeningClose the gaps in default configurations.
Default settings favour convenience over security. We harden your servers and cloud accounts against recognised benchmarks and fix the misconfigurations attackers look for first.
- Baselines aligned to CIS Benchmarks
- Cloud identity, storage and network configuration
- Logging and audit trail enablement
- Removal of unnecessary services and exposure
You receive: hardened systems, a record of the changes made and baselines to keep them that way.
07 Vulnerability management programmesFind, prioritise and fix weaknesses continuously.
Instead of waiting for the next annual test, we set up a repeatable process to scan your systems, prioritise what matters and track fixes through to closure.
- Scanning tool set-up and scheduling
- Risk-based prioritisation
- Remediation tracking and reporting
- Patch management process
You receive: a running programme with a schedule, owners and regular reporting.
08 Security architecture & design reviewBuild security in before systems go live.
We review new or existing systems, applications and cloud designs to spot weaknesses at the design stage, when they are cheapest and easiest to fix.
- Architecture and data flow review
- Threat modelling
- Cloud and network design review
- Recommendations ranked by risk
You receive: a design review report with prioritised recommendations.
What you receive
Controls that work, and a team that can run them.
Because we also test security, we check that what we build actually stops the attacks it is meant to stop.
Working configuration
Controls deployed and tuned for your environment, not left on default settings.
Documentation
Configurations, diagrams and decisions recorded so nothing depends on memory.
Runbooks
Step-by-step guides for the day-to-day tasks and alerts your team will handle.
Knowledge transfer
Walkthroughs and training so your team can operate and maintain everything.
- WORK ALIGNED TO
- CIS Controls & Benchmarks
- NIST CSF 2.0
- MITRE ATT&CK
- ISO/IEC 27001 Annex A
- PCI DSS v4.0.1
- CBN Risk-Based Cybersecurity Framework
Questions
Security engineering FAQs
Do you work with the tools we already have?
Yes, where they fit your needs. We start by getting more out of what you already own, and if you need something new, we help you choose options that suit your size and budget.
Will changes disrupt our operations?
Changes are planned with your team, made in agreed windows and tested with rollback options in place, so business systems keep running.
Can you work on-site and remotely?
Yes. We work with clients across Nigeria, on-site and remotely, depending on what the work requires.
How do we know the controls actually work?
We validate them before handover, using the same techniques we use in penetration testing, and can arrange a full test afterwards for independent assurance.
How is security engineering work priced?
It depends on the scope: the number of systems, users and locations, and how much is being built versus improved. After a scoping call you receive a written proposal with a fixed scope and price.
Strengthen your defences.
Tell us about your environment and we'll set up a scoping call. We respond within 1 business day.