Cybersecurity · A practice in both businesses
Security from the boardroom to the rack.
We set the governance, find the gaps, build the controls, watch around the clock and lead the response when something happens. One plan, five stages, one team leading it.
Where it usually starts
Problems we are asked to solve.
- Board or CEO“The board asked about our cyber risk and we did not have a clear answer.”Govern: a risk picture and plan in board language, owned by a named vCISO.
- CFO or COO“Our insurer wants controls we cannot evidence.”Assess and Build: measure against a standard, close the gaps, keep the evidence.
- IT leader“We have alerts, but nobody is watching at 2 a.m.”Monitor: 24/7 SOC and NOC coverage that escalates to people who know your environment.
- Compliance lead“We need to be audit-ready by a fixed date.”Assess and Build: readiness against SOC 2, NIST or CIS, with a dated plan.
- Anyone“We have been hit, or we think we have.”Respond: KTI takes the lead, brings in forensics, and gets you operating again.
- Operations“We do not know what our vendors expose us to.”Govern and Assess: third-party risk mapped, with clear actions for each supplier.
The framework
Govern. Assess. Build. Monitor. Respond.
Start at any stage. Most clients begin with Govern or Assess; some call us at Respond. Either way, the plan covers all five.
- 01 · Decide
Govern
Set ownership, risk appetite and a plan your board can stand behind.
- vCISO and board advisory
- Quarterly board cyber briefings
- Policy, risk and audit-ready controls, incl. ITGC
- Executive tabletop exercises
Led by KTI · tabletops with ORNA
- 02 · Measure
Assess
Measure where you are against a recognised standard.
- NIST, CIS and SOC 2 readiness
- Website and infrastructure exposure analysis
- Penetration testing
KTI · testing by ORNA
- 03 · Fix
Build
Security designed into the networks and systems, because we build and support them.
- Segmentation and access boundaries
- Identity and resilience
- Secure deployment and handover
Delivered by KTI
- 04 · Watch
Monitor
Eyes on your environment every hour of every day.
- 24/7 SOC
- Dark web monitoring
- Compliance and configuration drift
SOC by Cyrebro · escalation to KTI
- 05 · Act
Respond
Plans rehearsed before an incident. Containment, recovery and hardening after.
- Incident response programs and playbooks
- Containment and recovery
- Digital forensics
Led by KTI · with ORNA
Incidents we respond to
- Ransomware
- Business email compromise
- Credential theft
- Website compromise
- Third-party incidents
In each business
The same practice, applied where you are.
How we work
We lead. Specialists join where they are strongest.
KTI leads the client relationship and the scope it is contracted to lead. For penetration testing, forensics and tabletop exercises, we bring in specialist partners, including ORNA.
- KTILead and accountableOwns the plan, governance and vCISO work, assessments and remediation. Security is built into the networks we design and run. Leads every incident from first call to close.
- CyrebroMonitor · 24/7 SOCRuns the independent 24/7 security operations centre. Separate from the team that runs your systems, by design. Escalates to KTI.
- ORNAAssess · RespondDelivers incident response programs, tabletop exercises, penetration testing and digital forensics under KTI’s lead.
Proof
Board-level work, and the discipline to back it.
- Quarterly board cyber briefings for a utility client
- CEO briefing preparation and in-room support for nonprofits
- CISO-level experience on the team
Questions
Before you call.
Do you replace our internal IT or security team?
No. Many clients keep their team and use us for governance, 24/7 coverage and specialist work. Others hand us the whole function. The framework works either way.
Who actually watches our environment overnight?
Cyrebro runs the independent 24/7 SOC. Our 24/7 NOC watches infrastructure. Both escalate to KTI, which leads the response within its scope.
Can you get us ready for a SOC 2, NIST or CIS audit?
Yes. We assess against the standard, build a dated remediation plan, implement the controls and keep the evidence your auditor will ask for.
What happens in the first hour of an incident?
You call the incident line. KTI takes the lead, contains what it can, brings in ORNA for forensics where needed, and keeps your leadership informed at each step.
Do we have to use all five stages?
No. Start where the need is. We will show you how the stages connect so nothing important falls between them.
Find out where you stand.
Tell us what prompted the question: a board request, an audit, an insurer, an incident. We will route you to the right advisor.