Cybersecurity services that leave you audit-ready

System Patch Management

Most breaches exploit a vulnerability with a patch already available. We run scheduled patch windows across your whole estate, with pre-checks, snapshots and rollback, and give management a monthly compliance dashboard.

• Scheduled OS and application patching — Linux (apt/dnf), Windows (WSUS/Intune), hypervisors and firmware
• Zimbra, mail, web and database patch cycles with pre-checks and rollback snapshots
• Critical and zero-day emergency patching within agreed SLA hours
• Monthly vulnerability scan after patching to prove closure
• Compliance dashboard and audit-ready patch evidence

Vulnerability Assessment & Penetration Testing

We scan, then we prove. Automated internal and external scans establish the baseline; a scoped grey- or black-box penetration test shows what an attacker could actually reach, with proof-of-concept evidence and a remediation workshop.

• Internal and external vulnerability scans across servers, network devices and endpoints
• Web application testing aligned to OWASP Top 10 and OWASP ASVS
• Mail-platform testing — open relay, TLS, SPF/DKIM/DMARC, authentication and admin-console exposure
• Scoped grey / black-box penetration test with proof-of-concept exploits
• Executive summary, technical findings, prioritised remediation plan and re-test

Server & Network Hardening

A default install is not a secure install. We apply CIS Benchmarks to every server, lock down remote administration, enforce least privilege and segment the network so that a single compromised device cannot reach everything else.

• CIS Benchmark hardening for Ubuntu, RHEL-family and Windows Server
• SSH key-only access, MFA, sudo policy and least-privilege service accounts
• Host firewalls (ufw/nftables), fail2ban, SELinux/AppArmor and disk encryption
• Perimeter firewall, VLAN segmentation, VPN and secure remote administration
• TLS 1.2+/1.3 only, current cipher suites and valid certificates on every service
• Admin consoles restricted by IP/VPN with MFA

Monitoring, SIEM & Incident Response

You cannot respond to what you cannot see. We centralise logs, watch for intrusions and configuration drift, alert on capacity and availability, and respond to incidents within defined times.

• 24×7 monitoring and alerting — Zabbix, Prometheus/Grafana, uptime and capacity checks
• Centralised logging and SIEM (Wazuh / ELK) with log retention for audit
• Intrusion detection and file-integrity monitoring
• Incident response with defined response and resolution times
• Monthly service report with security events and trends

Backup & Disaster Recovery

A backup that has never been restored is a hope, not a plan. We design 3-2-1 backups with off-site and cloud copies, restore-test them every quarter, and document DR runbooks with agreed RPO/RTO targets.

• 3-2-1 backup design with off-site / cloud copies and immutable, ransomware-resilient storage
• Quarterly restore tests with signed verification reports
• Documented DR runbooks, RPO/RTO targets and failover drills
• Mail-platform, database and virtual-machine level backups

Compliance Readiness — ISO 27001 & Kenya DPA 2019

We assess the gap between where you are and what ISO/IEC 27001 and the Kenya Data Protection Act, 2019 require, then close it with policies, controls, evidence and trained staff.

• Gap assessment against ISO/IEC 27001 and the Kenya Data Protection Act, 2019
• Information security policy set, risk register and asset inventory
• Data-processing agreements, records of processing and breach procedures
• Staff security awareness and phishing-resilience training
• Annual review and evidence pack for auditors and procuring entities