Managed Cybersecurity and IT Services
A breach costs more than money. It costs trust.
Independent audits, strategic consulting, and managed cybersecurity for South African organisations where cyber risk is a board-level concern, not just an IT one.
Or call 012 012 5072 or message us on WhatsApp.
| Ref | Finding | Severity |
|---|---|---|
| F-02 | Remote admin access without multi-factor authentication | Critical |
| F-07 | Backups not restore-tested in the last 12 months | High |
| F-11 | Supplier access not reviewed since onboarding | Medium |
| F-14 | Incident plan lacks regulator notification timeline | Medium |
- Senior-led deliveryThe consultant on your first call does the work.
- CIS Controls alignedFindings mapped to the CIS Critical Security Controls.
- ISO 27001 frameworkEvidence referenced to ISO/IEC 27001 controls.
- POPIA alignedControls and reporting mapped to the POPIA security safeguards.
Engagements map to CIS Controls, ISO 27001, NIST CSF, ISO 22301 and OWASP.
Where engagements go from here
Most relationships start with an audit, cyber or AI. What happens next depends on what we find.
- Start here
Cybersecurity Audit
An independent, evidence-based assessment of your controls, processes and exposure. Fixed fee against a written scope.
See what's in an audit - Start here
AI Usage Audit
Shadow AI tool usage, data egress, vendor terms and regulatory exposure, in a board-ready report.
See the AI Usage Audit -
Managed IT Services
We run the whole IT function: helpdesk, security, cloud, devices and networking, with cybersecurity built in.
See the managed service -
AI Practice
AI governance and policy, implementation and agents, and private or on-premise AI for data that cannot leave the building.
Explore the AI Practice -
Penetration Testing
Manual testing by senior security consultants, not just automated scanners.
See penetration testing -
Incident Response
Ransomware, data breaches, email compromise. Rapid containment when every minute counts.
See incident response -
Consulting
Senior advisory on IT strategy, vendor selection, security posture and cloud migration, plainly spoken about risk.
Explore consulting -
Enterprise Architecture
Architecture that ties strategy, capabilities and technology together, so investment follows the business.
See enterprise architecture
Outcomes on the record
Client names stay confidential. Four anonymised engagements, each with the situation we found and what changed.
- AGRICULTURAL EXPORTER
Situation: A KwaZulu-Natal citrus exporter handling EU buyer data and POPIA-regulated seasonal worker records faced an Information Regulator enquiry after a phishing-led breach exposed roughly 1,800 worker ID numbers. The §22 clock and a parallel EU buyer audit demand both began the same week.
Outcome: POPIA §22 notification accepted by the Information Regulator with no enforcement order. EU buyer audit closed favourably. Full POPIA-aligned ISMS in place within 9 weeks; export relationship retained.
- JSE-LISTED RETAILER
Situation: A JSE-listed retail group with 2.8 million loyalty programme members suffered a ransomware incident over a public-holiday weekend. The Information Regulator opened an enforcement file once §22 notification was filed; JSE listing-rules disclosure window running in parallel.
Outcome: No loyalty data exfiltrated (forensically confirmed). JSE SENS announcement issued within the disclosure window. Information Regulator file closed with no fine. Continuing managed security engagement now covers the full loyalty data plane.
- MINING & RESOURCES
Situation: A platinum producer with operations in two provinces had a flat network architecture inherited from a 2018 expansion - no segmentation between corporate IT and operational technology. An MDR alert flagged reconnaissance against PLC firmware-update servers; estimated production stoppage cost R47M per pit per day.
Outcome: Segmentation in place across both sites within 8 weeks. Vendor remote access by jump-host only. No production stoppage. Ongoing OT-MDR engagement; quarterly readiness reviews built into the managed service.
- FINANCIAL SERVICES
Situation: A boutique asset manager with R8 billion AUM and a FAIS Category II licence expected an FSCA on-site visit driven by AI-tooling questions in recent supervisory dialogues. No documented model-risk framework for the AI-augmented research tooling staff had been using for 14 months.
Outcome: Full AI inventory delivered. Model-risk framework live. Supervisory dialogue passed without enforcement signal. AI Governance retainer in place; the organisation has since used the framework to win two institutional mandates that required AI governance documentation.
Want to hear it from a peer? We can arrange a reference call with a comparable organisation.
Ask on your consultationHow an engagement works
Three steps, written down. No hand-off to a junior at the end.
-
Initial consultation
A conversation with a senior consultant. We listen, ask the questions you have not been asked before, and tell you what we would do differently. No obligation.
-
Scoping and proposal
A written agreement on objectives, depth, timeline and price. Clear about what is in scope, what is not, and what evidence we will need.
-
Delivery and roadmap
An executive summary your board will read, a findings register your engineers can act on, and a prioritised roadmap with realistic dates.
What clients ask first
Not answered here? Ask it on the call.
We are smaller than the organisations on your case-study page. Are we wasting your time?
If your business has board-level cyber risk, and almost every regulated organisation does, we are the right shape of practice for you. The audits we run for a 40-person law firm look different from the ones we run for a 400-person fintech, but the rigour is the same.
We already have anti-virus, an MSP, and a firewall. Why an audit?
Because none of those answer the question your board will ask after an incident: did we know about this exposure, and if not, why not? An audit produces the document that answers that question, before the incident, not after.
How is this priced?
Fixed fee against a written scope. We never charge by the hour for audits: the incentive should be on us to be efficient, not on you to watch the meter. Managed services are a monthly retainer; consulting is project or fractional.
We do not have an internal IT team. Can you still help?
That is more common than you would think, particularly in mid-market professional services. We work alongside your outsourced IT supplier or, in managed engagements, take on the function in full.
What is your typical engagement timeline?
A standard cybersecurity audit runs four to six weeks from kick-off to final report. Managed services have a 30-day onboarding. Incident response is measured in hours, not weeks.
If we engage you for an audit, are you going to pitch us managed services?
We will tell you what we think the right follow-on is, including "you do not need a managed service, you need to fix three things and we will retest in six months." An audit that always ends in an upsell is not an audit.
A conversation, no commitment
Let's talk about your risk.
A 30-minute call with a senior consultant. Free of charge. No sales follow-up unless you ask for one.
Or call 012 012 5072 or message us on WhatsApp.
What happens next
- 01You tell us briefly what has landed on your desk.
- 02We respond within one business day to arrange a time.
- 03A 30-minute call with a senior consultant, and an honest view of what to do first.