Network Security.

Under 500 employees, managed detection-and-response (MDR) is the right call — the talent cost of running a 24/7 SOC in-house rarely makes sense at that size. Above 500 employees, hybrid MDR-plus-internal-SOC begins to pay back.

FortiGate, Palo Alto Networks PA-series, or Cisco. For small branch sites, a cloud-managed Cisco appliance is excellent (simple, low ops overhead). For headquarters, FortiGate offers the best price-performance with strong threat intelligence. Palo Alto is the premium tier with the deepest application-aware controls.

Every request is authenticated regardless of network location — there is no 'inside the firewall' implicitly trusted zone. Practical implementation: identity-driven access (single sign-on with MFA), device-posture checks before network admission, and micro-segmentation that contains lateral movement. We design to zero-trust principles for any new deployment in 2026.

EDR or XDR (CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint) on every endpoint that matters. Anti-virus alone is no longer sufficient; behaviour-based detection catches modern malware that signature-based scanners miss. We deploy and integrate with the SIEM for centralised visibility.

Immutable, offline-capable backups stored on infrastructure that cannot be modified by a compromised primary network. Veeam, Rubrik or Cohesity to a Wasabi or backblaze cold-storage tier with documented recovery testing. The most important security investment many organisations have not yet made.

Annually at minimum; semi-annually for regulated and high-value organisations. We coordinate with independent penetration-test firms (we don't audit our own work) and the findings flow into a remediation plan with documented closure dates. This is part of the AMC programme for premium clients.

We work with Fortinet, Sophos and Cisco firewalls, matched to the branch or headquarters role rather than fixed in advance. A small branch site and a headquarters call for different sizing and management models, so the platform follows the deployment. Final make and model are selected after the survey, endpoint count, bandwidth and security policy are reviewed.

Sizing follows the throughput the site actually needs with inspection enabled, the concurrent-session and user counts, the internet links to be terminated, and the headroom for growth — not the headline number on a datasheet. We size against a survey of the endpoints, bandwidth and the security features to be run. We do not promise a specific inspected-throughput or capacity figure before the design is validated for the site.

Segmentation is enforced through VLAN policy on the firewall and switching so guest, staff, voice, CCTV and building-system traffic stay isolated, with guest traffic on a captive portal and no path to internal systems. The policy is designed around the realistic access pattern and the client's security requirement rather than a generic template. It is agreed in writing and validated on site, and no security outcome is promised in the abstract.