Startups
Preemptive security programme for a scale-up
Crown jewels, identity, and detections that mean something
Situation
Tools exist. Architecture does not. Privileged accounts are shared. The same flat network serves a laptop and the customer path. Alerts fire; nobody can tell signal from weather. A tabletop exercise has never been run to failure.
Approach
How we would run it.
01
Crown-jewel workshop with the people who own the product, not only whoever holds the admin passwords.
02
Identity and segmentation first. Monitoring second. Tools third — and only for the use-cases the architecture implies.
03
Detection engineering against the paths an adversary actually uses against a Nigerian startup or organisation.
04
Playbooks and a rehearsal cadence. Response is a team sport that atrophies without practice.
Target outcomes
Targets for a programme of this class — not claimed results from a named client.
- Known
- Inventory of crown jewels and privileges
- Hours
- Target time to contain a mailbox incident
- Use-case
- Detections tied to paths, not product defaults
Practices involved
More programmes
Next step
Bring us the hard programme.
If the work needs architecture, security, and a team that will still be there at go-live, we should talk. Discovery conversations are with a senior architect — not a queue.