01 2 to 3 weeks
Assess
We map endpoint, identity, and network exposure and agree what to fix first.
Deliverables
- Exposure assessment
- Prioritized hardening plan
Service line
Cybersecurity engineering services built around how your systems run.
Our cybersecurity engineering services assess, harden, and monitor enterprise environments: endpoint, identity, network, and AI system security.
Problems we are called in for
Where security programs lose ground.
-
An audit found gaps, and nobody owns the fixes
Findings sit in a spreadsheet with no owner, no priority, and no deadline. We turn them into a hardening plan ranked by operational risk, with a named owner for each item.
-
Access has grown faster than anyone can review it
Service accounts, contractor access, and legacy groups carry more privilege than the work needs. We map who can reach what, then reduce it.
-
AI systems are live, and security monitoring cannot see them
Models, prompts, and data pipelines sit outside existing detection. We extend monitoring to cover them alongside endpoints and the network.
-
Plant systems and office IT share a network
An incident on one side can reach the other. We design the segmentation and the monitoring so that it cannot.
What we deliver
Findings your team can act on, and evidence your auditors can read.
- Exposure assessment
- Endpoint, identity, and network exposure, mapped to the NIST CSF 2.0 functions.
- Prioritized hardening plan
- Each finding with an owner, a fix, and a priority set by operational risk.
- Detection coverage map
- Which MITRE ATT&CK techniques your monitoring can see today, and which it cannot.
- Incident response runbooks
- Step by step procedures for the incidents most likely in your environment, and who acts at each step.
How we work
Four phases, each with named deliverables.
The same four phases as every Desprings engagement, applied to security work. Durations are defaults, agreed for each engagement.
-
- 02 6 to 10 weeks
Pilot
We apply the first hardening changes to one environment and measure the effect.
Deliverables
- Hardened pilot environment
- Detection rule test results
- 03 4 to 8 weeks
Harden
We roll the changes out across the environments in scope and close the findings.
Deliverables
- Closed findings
- Detection coverage map
- 04 Ongoing
Operate
We monitor with your team, or hand over with everything needed to run it.
Deliverables
- Incident response runbooks
- Service reviews
Standards and tooling
The references we work to.
Naming a standard means we use it as a working reference. Our certifications are listed on the Trust Center .
| Reference | What it covers | How we use it |
|---|---|---|
| NIST CSF 2.0 | Cybersecurity risk outcomes | Structures the assessment and the plan |
| CIS Controls v8.1 | Prioritized safeguards | Baseline for hardening work |
| MITRE ATT&CK | Adversary tactics and techniques | Measures what monitoring can detect |
| NIST SP 800-61r3 | Incident response | Structure for the response runbooks |
| NIST SP 800-207 | Zero trust architecture | Reference for identity and segmentation design |
| OWASP Top 10 for LLM Applications | Security risks in language model systems | Checklist for AI system testing |
Procurement questions
What your team will ask before the first call.
What happens in the first phase?
The first phase is Assess. It runs 2 to 3 weeks by default and ends with a prioritized plan. You decide whether to continue after it.
Do you cover AI systems as well as infrastructure?
Yes. Models, prompts, data pipelines, and their integrations are assessed and monitored alongside endpoints, identity, and the network.
Which standards do you work to?
NIST CSF 2.0, CIS Controls, MITRE ATT&CK, NIST SP 800-61r3, and NIST SP 800-207, used as working references. Naming a standard is not a claim of certification against it.
Where can we see your own certifications?
The Trust Center lists every certification and audit report we hold, with its scope, auditor, and dates. Anything not listed there is not claimed.
What do we receive at exit or handover?
The detection coverage map, the incident response runbooks, and the record of closed findings, so your team can run the controls without us.
Bring us the program your team is worried about.
A senior engineer replies within one business day. The first call is a technical conversation, not a sales presentation.