Cybersecurity services
Assessments, endpoint protection, email security, training, incident readiness, and 24/7 monitoring for managed-service clients.
Cybersecurity
Security assessments and risk reviews
You cannot fix everything at once, and should not have to guess what matters most. We review how you are actually set up, rank risks by likelihood and impact, and give you an actionable plan.
Who this service is for
A good fit if
- You have never had a security review, or yours is out of date.
- An insurer, client or board wants evidence of how you protect data.
- Since growth, a merger or a cloud move, you are unsure what changed.
- You face NDPA security duties, the CBN cybersecurity framework or a client questionnaire.
What is included
- Scoping document: systems, locations and questions in scope
- Review of identities, devices, email, network, backups and cloud
- External vulnerability scan of internet-facing systems, explained
- Risk register ranking every finding by likelihood and impact
- Remediation roadmap with quick wins, owners and effort estimates
- Executive summary for leadership, a board or an insurer
What this service is
A structured review against the attacks that most often cause harm (stolen passwords, phishing, ransomware, unpatched systems, misconfigured cloud), ending in ranked risks and a practical plan, not scanner output. We measure against recognised baselines, the CIS Critical Security Controls and the NIST Cybersecurity Framework, with current ngCERT advisories in mind. Findings are mapped to any specific requirement: the Central Bank of Nigeria's cybersecurity framework for banks and payment service providers, the security duties in the Nigeria Data Protection Act 2023, or a client's questionnaire.
What we look at
| Area | What we check |
|---|---|
| Identities and access | Accounts, admin rights, missing MFA, password policies, joiners and leavers |
| Devices | Patching, disk encryption, endpoint protection, who can install software |
| Email and collaboration | Filtering, SPF, DKIM, DMARC, external sharing, abused mailbox rules, Microsoft 365 or Google Workspace settings |
| Network and remote access | Firewall rules, VPN, Wi-Fi, backup internet links, services exposed to the internet |
| Backups and recovery | Coverage, whether attackers could reach them, last tested restore |
| Cloud services and vendors | Key platform configuration, third-party access |
| People and process | Training, incident response, verifying payment or bank account changes |
| AI tools, if in scope | AI services staff use, data reaching them, prompt injection and leakage defences (AI governance) |
See a sample risk register
Demonstration, not a client project
Three rows from an invented risk register, showing the format we use:
| Finding | Likelihood | Impact | Recommended fix | Effort |
|---|---|---|---|---|
| Two administrator accounts have no MFA | High | High | Enforce MFA and move admins to separate accounts | Low |
| Backups stored on a share reachable by all staff | Medium | High | Isolate backups and test a restore | Medium |
| No DMARC record on the main email domain | High | Medium | Publish DMARC in monitoring mode, then enforce | Low |
Safe to run, useful afterwards
We use read-only access through named accounts removed at the end, share findings only with people you name and delete assessment data as agreed. You decide who sees what: the summary suits insurers or clients, the technical report your IT team.
Protect what matters
Your business and data guarded from intruders, biggest risks first.
Keep leaders focused
A clear roadmap instead of recurring security fire drills.
Budget calmly
The roadmap shows the order and estimated effort of the work.
Answer with evidence
For insurers, clients, regulators and boards, rather than assurances.
Fix findings with your team, another provider or us, as a project or within managed IT services with ongoing security (the assessment doubles as its baseline). Common next steps: EDR deployment, email security, awareness training.
Delivery
How the work is delivered
Scope
Systems, sites and questions in scope, plus the rules and time windows for any scanning.
Output: Signed scope, scanning authorisation.
Collect
Configuration review, approved scans and short interviews with the people who run your systems.
Output: Evidence and raw findings.
Analyse
Findings compared with a recognised baseline and ranked by likelihood and impact on you.
Output: Risk register.
Report
Leadership and IT walked through the findings, quick wins and longer-term roadmap.
Output: Summary, technical report, roadmap.
Follow up
After an agreed period, we check the fixes made and update the register.
Output: Retest note, updated register.
Scope at a glance
Not included unless agreed
- Fixing findings: quoted separately or under managed security
- Certification, audit opinions or legal conclusions on compliance
- Physical testing, in-person social engineering, systems outside scope
What we need from you
- Read-only admin access, and written authorisation before any scanning
- Time with IT, finance and operations; any existing inventory
- Policies, insurer questionnaires and contracts with security clauses
Before handover
- Every finding ranked, with evidence, a plain risk description and a fix
- Scans run only within written authorisation and agreed time windows
- Leadership walkthrough; assessment data stored securely, deleted as agreed
What affects the cost
- Users, devices, servers and sites
- Cloud services and applications in scope
- External and internal scanning; retesting after fixes
- Mapping to the CBN framework or ISO/IEC 27001
No package prices: estimates in naira from an agreed scope, taxes shown separately.
Questions buyers usually ask
How is this different from a vulnerability scan?
A scan finds known technical weaknesses on the systems it can reach. An assessment also checks how accounts, email, backups and processes are set up, and explains which risks matter for you. Scanning is one input, not the whole picture.
Will the assessment disrupt our staff?
Very little. Most of the work is configuration review and short interviews. Any scanning is authorised in writing and scheduled in agreed windows.
Does a good result mean we are compliant?
No. It shows how well your controls reduce risk and where the gaps are. Compliance with the Nigeria Data Protection Act or sector rules such as the CBN's is a legal question for your counsel, and certification comes from an independent body. See compliance readiness.
How often should we repeat it?
Typically once a year, and after major changes such as a merger, a move to the cloud or a significant incident. Managed-service clients receive ongoing reviews under their agreement.
Related
Privacy and compliance readiness
Privacy and security practices ready for regulators, clients, auditors and insurers, gaps fixed before anyone asks.
Lessons from the largest data breaches
Four lessons from large breaches, what they mean for you, and an NDPA-aware readiness checklist.
Want to know where you stand?
Tell us about your organisation and what prompted the question. We will arrange a scoping conversation.