Cyber Security

The full defensive stack for a New Zealand business: threat monitoring, endpoint and email protection, multi-factor authentication, security awareness training, backups, security audits, and incident response. Our endpoint protection runs on Huntress EDR, which watches every laptop, desktop, and server around the clock, and our identity monitoring flags suspicious Microsoft 365 sign-ins, privilege changes, and account takeovers before they become breaches. For businesses that need to meet a formal standard — SMB1001, CIS Controls, or ISO 27001 — we run managed security programmes that take you from gap assessment through to certification. The design principle behind all of it is layering: no single control is trusted to hold on its own, so a phishing email that gets past the filter still meets multi-factor authentication, a compromised device still gets isolated by EDR, and a worst case still recovers from tested backups.

With layers, because that's what actually works. Email filtering blocks the bulk of phishing before anyone sees it. Multi-factor authentication means a stolen password isn't enough to get in. Staff awareness training and simulated phishing teach your team to recognise the attempts that do get through — people are the most common entry point, so we treat them as part of the defence rather than the weakness. Huntress EDR monitors every device for the behaviour ransomware shows before it detonates, and can isolate an infected machine from the network in minutes. And underneath everything sit tested backups of your servers, Microsoft 365, and Google Workspace, so even a successful attack becomes a recovery exercise rather than a ransom negotiation. Most attacks rely on finding one weak point; the layered approach means one failure doesn't expose the whole business.

Yes, and we'd argue it's one of the highest-value security investments a small business can make, because most successful attacks start with a person rather than a technical exploit. Our training is ongoing rather than a one-off seminar: your team gets short, regular sessions on recognising phishing emails, avoiding social engineering, and handling data safely, reinforced with simulated phishing campaigns that safely test whether the lessons stick. The simulations matter — people who have clicked a fake phishing email in a controlled test are far more careful with the real thing. You get reporting on how your team is tracking over time, so you can see the click rate fall and know who needs a refresher. The goal is a culture where staff spot something odd and report it early, turning your people from the most common entry point into your first line of defence.

First we contain it: isolating affected machines, revoking compromised credentials, and stopping the spread, because the damage of an incident is mostly determined by how fast that happens. Then we recover — restoring systems and data from clean, tested backups so you're back operating, and verifying the attacker no longer has a foothold before anything reconnects. Then we work out what happened: how they got in, what they touched, and what changes stop it recurring, delivered as a plain-English report rather than jargon. Where required, we support your reporting obligations, including notifying CERT NZ and, if personal information was involved, notifiable breach reporting to the Privacy Commissioner and affected parties under the Privacy Act 2020. For our managed clients, incident response isn't a separate emergency purchase at panic pricing — it's part of the relationship, and the monitoring usually means we're acting before you've had to call.

Yes. We start with a security audit that maps your current systems against what your obligations actually require — the New Zealand Privacy Act 2020 for any business holding personal information, plus whichever framework fits your situation: SMB1001 for small businesses wanting a recognised baseline, CIS Controls for a more technical standard, or ISO 27001 where clients or contracts demand certification. Increasingly it's not regulators driving this but customers: larger organisations now routinely require security certification from their suppliers, and we've taken clients through that process end to end, from gap assessment through remediation to certification. What you get from us is a plain-English view of where you stand, a prioritised list of what to fix first, and someone to do the heavy lifting — because the point of compliance work is to actually be more secure and win the contracts, not to produce a binder nobody reads.

Start with a security audit. We assess your environment as it actually is — devices, Microsoft 365 configuration, identity and access, backups, patching, and how your team handles the basics — and measure it against where a business like yours should be. What you get back is not a generic checklist or a scare-tactics sales document: it's a prioritised plan, in plain English, showing the gaps that genuinely matter, roughly what each fix involves, and which order to do them in so the highest-risk items close first. Clients consistently tell us the value is in finally knowing. Key Industries' CFO put it as having no more blind spots — knowing exactly where they stand rather than hoping. If you become a managed client, this happens automatically: every new client gets a cyber security assessment as part of onboarding, with a baseline and a roadmap by around day 75.