Risk audit and assessment
External and internal vulnerability scanning, configuration review, identity and access review, and a prioritised remediation plan you can budget against.
Overview
Know your exposure before somebody else finds it
The businesses that get hurt are rarely the ones without security products. They are the ones where nobody was watching the alerts, the firewall rules had grown organically for six years, and the backup had been failing silently since March.
COREQ approaches security in the order that actually reduces risk: find out what is exposed, fix the cheap and obvious things first, then put monitoring in place so the next problem is caught while it is still small.
Scope at a glance
- Cyber risk audit, review and testing
- Vulnerability assessment and remediation planning
- Endpoint detection and response (EDR/XDR)
- Firewall, email and web security hardening
- 24/7 managed SOC monitoring and alert triage
- Backup, recovery and incident response readiness
Final scope is confirmed after a site survey and issued in writing before work begins.
What's included
How we deliver Cyber Security & SOC
Endpoint detection & response
Modern EDR/XDR on every laptop, desktop and server — behavioural detection, isolation of compromised devices, and rollback where the platform supports it.
Managed SOC monitoring
Log collection and correlation with round-the-clock alert triage, so genuine incidents are escalated to a human instead of sitting in a console nobody opens.
Identity and email security
Multi-factor authentication, conditional access, phishing protection, impersonation defence and mailbox rule monitoring.
Backup and recoverability
Immutable and off-site backup copies, with documented restore procedures and scheduled restore tests — the last line of defence against ransomware.
Security awareness
Phishing simulation and short, practical staff training, because the majority of successful intrusions still begin with someone clicking something.
Engagement models
Matched to the size of the problem
We would rather scope you correctly than sell you the largest option. If a smaller package genuinely covers your requirement, that is what we will propose.
Assessment
Point-in-time review
- Vulnerability scan
- Configuration and policy review
- Prioritised findings report
- Remediation roadmap
Managed protection
Ongoing prevention
- EDR deployment & management
- Firewall & email security management
- Patch and hardening cycle
- Monthly posture report
Managed SOC
Continuous monitoring
- Everything in Managed protection
- 24/7 log monitoring and triage
- Incident escalation procedure
- Threat hunting and reporting
How we work
A delivery method that removes surprises
Every engagement follows the same six stages. You always know which stage you are in, what has been agreed, and what is outstanding.
Discovery & site survey
We visit the site, understand how you actually work, and document the existing environment before proposing anything.
Design & proposal
You receive a written scope, a design, a bill of materials and a price — with assumptions and exclusions stated plainly.
Delivery & installation
Scheduled work with an agreed programme, minimal disruption to operations, and progress visibility throughout.
Testing & commissioning
Every device tested, every interface demonstrated, and defects closed before handover rather than after.
Handover & documentation
As-built drawings, device schedules, credentials and O&M documentation handed over in a structured pack.
Support & AMC
Ongoing maintenance, monitoring and helpdesk support under an annual contract with defined response targets.
Frequently asked
Questions we are asked most
A Security Operations Centre is the function that watches security telemetry continuously and decides which alerts matter. You need one if a breach would materially disrupt your operations or expose regulated data. If your business could absorb several days offline without serious consequence, a well-managed endpoint and email security stack may be proportionate — we will say so rather than oversell.
Signature-based antivirus catches known malware. It does not catch an attacker using stolen credentials and legitimate administrative tools, which is how most serious intrusions now progress. EDR looks at behaviour rather than file signatures, which is why it detects the activity antivirus misses.
The response procedure is agreed in advance: containment steps, who is called, in what order, and what evidence must be preserved. Having that written down before an incident is most of what separates a controlled recovery from a chaotic one.
Yes. Cyber risk auditing, review and testing is one of our licensed activities and can be engaged independently of any managed service — useful when you need an objective assessment of an environment maintained by someone else.
Related services
Often delivered alongside
Managed IT & AMC
Fixed-fee IT support that keeps your users working — remote helpdesk, scheduled preventive maintenance and on-site engineers under one annual maintenance contract.
Read moreCCTV & Surveillance
IP surveillance designed around what you actually need to see — correct camera selection, honest storage sizing, and a system that still works two years after handover.
Read moreAccess Control & Attendance
Control who goes where, and know who was on site — card, PIN, biometric or mobile credential, with attendance data your HR team can actually use.
Read moreLet's scope it properly before anyone quotes a price.
Tell us what you are trying to solve. We will survey the site, put a written scope and design in front of you, and price it with the assumptions stated plainly.