Cybersecurity

What we take on

Finding what is exposed, closing it, and making sure it stays closed. Assessment, hardening, monitoring, and the policies and training that decide whether any of it survives contact with a busy Tuesday.

Most breaches we are called about are not clever. They are a password reused from a service that was breached elsewhere, an old account nobody disabled, or somebody doing exactly what a convincing email told them to do.

How it runs

An assessment first, against the systems you actually have rather than a generic checklist. You get a written finding list ranked by what an attacker would reach first, with the fix for each one and what it would take.

Then the work: multi-factor authentication where it matters, least privilege on the accounts that have more than they need, logging that somebody reads, and a tested plan for the day something does get through. We report on that monthly under the MSLA.

What it costs to get wrong

Under the Nigeria Data Protection Act a breach involving personal data is a notification obligation, not just an inconvenience. The technical recovery is usually the cheap part; the expensive part is telling customers, and the reason most organisations delay is that nobody kept the logs that would say what was taken.