What we do
Three sectors in depth, five in brief
Every sector breaks in its own way. The first three have full pages; the others fit in a few lines below.
In depth
In brief
Technology and SaaS
Your customers send security questionnaires, ask for a SOC 2 report and, in finance, treat you as a critical ICT provider under DORA. We help you prove it without slowing your teams down.
Risky releases
One faulty update can hit every customer at the same instant, as the 2024 CrowdStrike outage showed worldwide. A staged rollout, with clear stop criteria, limits an incident to a fraction of your base rather than all of it.
Single region
A regional outage at your cloud provider can stop the service even when your own code has no defect. Relying on a single region is a bet that provider will never have an incident for the entire lifetime of your product.
Manufacturing, transport and logistics
Plants, warehouses and transport operations depend on tightly linked IT and operational systems. We help you understand those dependencies and prepare a realistic manual mode.
IT/OT boundary
An attack that only hits IT systems can still force production to stop as a precaution, as Norsk Hydro showed in 2019. Without clear visibility into the IT/OT boundary, the safest decision is often to stop everything, at the highest possible cost.
Directory and privileged accounts
Active Directory is often the key to the whole infrastructure: whoever has admin access there can, in principle, reach everything. Its loss or compromise complicates recovery for every other system that depends on it, exactly what drew out the Norsk Hydro incident.
Norsk Hydro: producing by hand rather than paying The CrowdStrike outage: when one update grounds the planes
Retail
Retail combines stores, warehouses, e-commerce and payments in a tightly coupled system. We help protect the human entry points and prepare a credible degraded mode.
Social engineering
Help desks and outside providers are targeted through social engineering to reset access or authentication factors, as reported in the 2025 Marks & Spencer attack. Strong identity verification at this entry point often stops the attack before it starts.
Coupled systems
Orders, stock and payments are so tightly coupled that they almost always go down together, never just one at a time. A degraded mode improvised on the spot isn't enough: it has to be designed, documented and rehearsed before the outage happens.
Professional services
Firms run on email, documents and collaboration tools, and face increasingly demanding security questionnaires. We help secure what matters and prove it.
Email compromise
A compromised mailbox opens the door to payment fraud and leaks of confidential client documents, often without any technical alert ever firing. For a firm, the trust lost can cost more than the incident itself.
SaaS data
Documents and email are rarely backed up outside the collaboration platform itself, leaving little recourse if something is deleted by accident or by an attacker. An independent, tested copy is the only real guarantee that everything can be recovered.
Public sector and non-profits
Public and community organizations are increasingly targeted, often with few specialist resources. We prioritize the most effective measures for the available budget.
Limited budgets
With a limited budget, you have to choose the measures that reduce risk the most per dollar spent, rather than aim for completeness. A few well-chosen measures often protect better than an ambitious program that never gets finished.
Services to citizens
An interruption directly affects the public the organization serves, often people who have no other option during a prolonged outage. That responsibility justifies protecting essential services even when the security budget stays modest.