// 06 SECURITY
Security Monitoring & Awareness Training
Ongoing monitoring plus phishing and secure-coding training for your team.
Merges what used to be listed separately as security monitoring, managed security and security awareness training into one ongoing service.
What's included
- Monitoring: log collection, alerting, uptime and integrity monitoring, monthly security review, with rapid response during business hours and an escalation path for critical after-hours alerts
- Phishing awareness sessions
- Simulated phishing campaigns
- Secure-coding workshops for developers
Our methodology
- 1Monitoring setup: log collection and alerting configured for the systems that matter most, with clear thresholds for what triggers an alert.
- 2Monthly review: a human actually looks at the trends and alerts each month, not just an automated dashboard nobody checks.
- 3Phishing simulation: realistic, non-punitive simulated phishing campaigns, followed by short, practical training.
- 4Secure-coding workshops: hands-on sessions for developers, using examples from your own codebase where possible.
What you get
- Monthly security review report
- Phishing simulation results and training completion
- Secure-coding workshop materials
What to expect
- Ongoing visibility into your systems, instead of finding out about a problem from a customer.
- A measurable drop in phishing-simulation click rates over successive campaigns.
- Developers who recognise and avoid the specific mistakes that led to real vulnerabilities in the past.
Limitations
Honest scope, not a sales pitch — here's what this service doesn't cover.
- Monitoring is based on the logs and access agreed at setup; systems added later need to be added to the monitoring scope.
- This is scheduled monitoring and monthly review, not a 24/7 security operations centre, unless separately agreed.
- Training changes behaviour gradually — a single session will not eliminate phishing risk on its own; it works best as an ongoing programme.
FAQ
Is this a 24/7 SOC service?
Not by default — it's log collection, alerting and monthly review with rapid response during business hours. We'll agree an escalation path for critical after-hours alerts, and can scope 24/7 monitoring separately if you need it.
How often are phishing simulations run?
Typically monthly or quarterly, scaled to your team size — frequent enough to build habit, not so frequent it becomes noise.
Do you train non-technical staff too?
Yes — phishing awareness is aimed at everyone; the secure-coding workshops are specifically for your developers.
// PROCESS
How this engagement works
- // 01
Free consultation
30 minutes to understand your setup and concerns.
- // 02
Scoped proposal
Fixed scope, fixed price, clear timeline. NDA signed before any access.
- // 03
Testing & review
We test safely, with written authorisation, inside agreed boundaries.
- // 04
Report & fix
Plain-language report, prioritised by risk, and a free re-test after you fix.
Authorisation & safety
Every engagement starts with written authorisation and, where appropriate, a signed NDA — we never test a system without the owner’s explicit permission. Testing is scoped and scheduled with you in advance, avoids destructive techniques by default, and stays inside the boundaries agreed before any work begins.
// FROM THE BLOG
Further reading
Agentic SOC: How AI Is Actually Changing Security Operations in 2026
AI agents are starting to triage alerts and investigate incidents autonomously — but most teams still keep a human in the loop for good reason. Heres where agentic SOC technology actually stands, and what it means for smaller security teams.
Business Email Compromise in 2026: How Attackers Bypass MFA
Multi-factor authentication stops most credential attacks, but not all of them. Here is how modern business email compromise campaigns get around MFA, based on 2026 threat data from Microsoft.
Deepfake Attacks on Businesses: How to Defend Against AI-Powered Impersonation
Gartner names deepfakes among the critical threats where attackers currently have the advantage. Here is how deepfake fraud actually works against businesses, and the verification habits that stop it.
Ready to talk through your scope?
Book a free consultation. No obligation, no pressure.