Service 06
Managed security
services
The ongoing work — monitoring, vulnerability management, advice when a decision needs making — for organisations that need a security function without building one from nothing.
In short
Managed security services provide continuing security operations and advisory capability as an ongoing service rather than a one-off project. Assessment work tells you what is wrong on a given date; managed services are what stop the list growing again while nobody is watching it.
The problem this solves
An audit or a penetration test produces a list of findings and a plan. Six months later, the plan has been overtaken by three releases, two new SaaS platforms, a change of hosting and a staff departure, and nobody has looked at the list since the quarter it was written. This is the ordinary fate of security work in organisations without a permanent security function — not negligence, just the absence of anyone whose job it is.
What we typically run
Monitoring and alert triage
Monitoring across your existing estate — endpoints, cloud tenants, identity providers and critical applications — with alerts triaged, within the coverage hours and response times defined for your estate, by someone who can distinguish a genuine signal from noise. We work with the tooling you already own wherever possible; replacing a platform is a decision with its own business case, and it should not be a side effect of hiring a security service.
Vulnerability management
Regular authenticated scanning across infrastructure, applications and cloud configuration, with results triaged rather than forwarded. A raw scanner export is a burden, not an output: the value is in filtering false positives, prioritising by exploitability and exposure rather than raw CVSS, tracking remediation to closure, and verifying fixes actually landed.
Cloud and configuration drift
Continuous review of AWS, Azure and Google Cloud configuration against benchmarks, watching for the changes that quietly reintroduce risk: a storage bucket opened for a migration and never closed, a role widened for a deployment and never narrowed, a security group edited at two in the morning.
Virtual CISO
Senior security leadership on a defined, part-time basis: owning the risk register, setting and sequencing the security roadmap, answering customer security questionnaires and due diligence, advising the board, and providing the named accountable owner that frameworks and auditors require. Suited to organisations that need the judgement of a security leader well before they can justify the salary of one.
Advisory on call
A named contact for the questions that come up between projects — is this vendor's architecture acceptable, does this integration need a review, what do we tell this customer's security team, is this alert worth escalating. Often the highest-value part of the arrangement, because it catches decisions before they become findings.
How engagements are structured
Every engagement defines, in writing: which systems are covered, what we monitor and what we explicitly do not, response times by severity, who can authorise action on your behalf, how we escalate out of hours, and what reporting you receive and when. Ambiguity about the boundary between your responsibilities and ours is the most common failure mode in managed security relationships, so we make the boundary explicit and revisit it as the estate changes.
Where the arrangement includes incident support, the terms are agreed in advance so that a live incident starts with investigation rather than contract negotiation. See incident response for what that covers.
What you receive
A typical engagement delivers the following. Coverage, response times and reporting cadence are defined in writing for your estate rather than sold as a fixed package.
- Regular reporting on posture, findings, remediation progress and trend — written to be read, not to fill pages.
- A maintained risk register that reflects the estate as it is now rather than as it was at the last audit.
- Triaged, prioritised vulnerability data with remediation tracked to verified closure.
- A named contact who knows your environment, so context does not have to be rebuilt every time.
- Evidence output that supports ISO 27001, SOC 2 and similar obligations as a by-product of ordinary operation.
Expert validation on top of the scanner you already own
Most organisations already run a vulnerability scanner. What they lack is the time to work out which of its results matter. We layer expert validation, exploitation analysis and false-positive triage on top of your existing scanning programme, integrating with the scanner you already own rather than replacing it. Each result that survives triage is confirmed by a consultant, with evidence and reproduction steps, and each that does not is closed with a stated reason.
Independent triage and re-scoring
Scanner severities rarely match your environment. We re-score validated findings against your own vulnerability management scoring — CVSS v4.0 or v3.1 as your platform requires — with the exploit-maturity modifier stated, so the queue your engineers work from reflects actual risk in your estate rather than a vendor default. Systemic patterns are reported once, with one centralised fix, rather than as hundreds of identical tickets.
Questions we are asked
Do we need managed security if we already have an IT provider?
They answer different questions. An IT provider is measured on availability and support: keeping systems running and users working. Security work frequently asks for the opposite trade-off — restricting access, enforcing patching windows, disabling convenient features. Both functions are legitimate, but combining them puts the same team on both sides of an argument. In practice we work alongside your IT provider rather than replacing them, and the independence is the point.
What is a virtual CISO, and when does it make sense?
A virtual CISO is an experienced security leader engaged part-time to provide the strategy, governance and accountability that a full-time Chief Information Security Officer would — risk ownership, roadmap, board reporting, customer assurance — without the cost of a permanent executive hire. It typically makes sense when customers or regulators have started asking who owns security, when compliance obligations require a named accountable owner, or when security decisions are being made ad hoc by whoever is nearest.
Will you replace our existing security tools?
Not by default. We are vendor-neutral and take no commission from security products, so there is no incentive on our side to move you onto anything. We work with what you have, and if a tool is genuinely inadequate for what you need we will explain specifically why and what the alternatives cost — as advice you are free to ignore, not as a purchase attached to the service.
What size of organisation is this for?
Typically organisations large enough to have meaningful risk but not large enough to justify a permanent in-house security team — often somewhere between the point where a customer first sends a security questionnaire and the point where hiring a full-time security lead becomes obviously affordable. The scope is sized to the estate rather than to a fixed package.
How is this different from buying a SOC?
A security operations centre is one component: detection and alerting on telemetry, usually at scale and around the clock. Managed security as we deliver it is broader and more advisory — vulnerability management, configuration and drift, risk ownership, customer assurance, and someone to ask before a decision is made rather than after an alert fires. If continuous, high-volume monitoring is your primary need, we will tell you honestly whether a dedicated SOC provider is the better fit.
Next step
Talk to a security consultant
Tell us what you are building, defending or certifying. We will tell you plainly what we would test first, what it takes, and whether you need us at all.