Strategy · Risk governance · Operational defence

From first assessment to ongoing defence.

Six service areas, one accountable lead. We help organisations assess their posture, reduce risk, meet compliance requirements and run practical security operations, from executive roadmaps to ongoing managed support.

GRC & compliance

Governance, risk & compliance

A defensible programme your board, auditors and customers can trust. Executive advisory, risk governance and regulatory readiness, from the first policy set to audit day.

Outcome: A structured, measurable and defensible security programme.

  • NIST CSF 2.0 alignment
  • ISO/IEC 27001 implementation and readiness
  • SOC 2 readiness and control assessments
  • HIPAA, GDPR and NIS2 compliance programmes
  • PCI DSS scoping and readiness
  • IT general controls readiness for pre-IPO and newly public companies
  • Policies, standards and procedures
  • Risk registers and enterprise risk management
  • Third-party and vendor risk management
  • AI governance and secure AI adoption
  • Audit preparation and remediation tracking
Vulnerability management

Vulnerability & exposure management

Fix what attackers are actually using, first. Risk-based prioritisation driven by live exploitation data, with remediation tracked to closure.

Outcome: Fewer exploitable weaknesses, and clear visibility of remediation progress.

How our vulnerability management works

  • Vulnerability scanning oversight and analysis
  • Risk-based prioritisation (CISA KEV, EPSS, CVSS)
  • Remediation planning and patch timelines
  • Patch management oversight, with your IT team or MSP
  • External attack-surface assessments
  • Cloud configuration risk reviews
  • Executive dashboards and reporting
  • Continuous exposure management
Incident response & SOC

Incident response & security operations

Detect, respond and recover, with a plan people have rehearsed. Response planning, tabletop exercises, SOC maturity and hands-on incident coordination.

Outcome: Faster detection, a coordinated response and a cleaner recovery.

Monitoring coverage, response times and out-of-hours availability are defined in each service agreement.

  • Incident response plans and playbooks
  • Leadership tabletop exercises
  • SOC and security-operations maturity assessments
  • SIEM and EDR optimisation
  • Triage and escalation procedures
  • Incident response coordination and retainers
  • Digital forensics and recovery through vetted specialists
  • SOC operating-model design
Assessments

Cybersecurity assessments

Know where you stand before you invest. An independent view of your security posture, with findings ranked and costed.

Outcome: A clear picture of your weaknesses and a prioritised plan to fix them.

  • Enterprise security posture assessments
  • Microsoft 365 and cloud security reviews
  • Identity and privileged-access reviews
  • Network architecture and configuration reviews
  • Endpoint and control-effectiveness reviews
  • Security architecture assessments
  • Third-party security assessments
  • Penetration testing through authorised partners
Strategy & vCISO

Security strategy, roadmaps & vCISO

Turn findings into a plan, and a leader to own it. Fractional executive leadership and roadmaps that tie security spend to business risk.

Outcome: Security investment aligned with business priorities and measurable risk reduction.

  • Fractional and interim CISO (vCISO)
  • 90-day improvement plans
  • 12-month programme roadmaps and multi-year strategy
  • Security maturity assessments
  • Budget and investment prioritisation
  • Security technology rationalisation
  • Board and executive reporting
  • Group-wide and multi-region programmes
Managed security

Managed security & team augmentation

Senior expertise on tap, without building a department. Ongoing programme support and specialist capacity alongside your team or MSP.

Outcome: Flexible access to security expertise and day-to-day operational support.

Delivered directly by JT Cyber Group or with vetted MSP partners and subcontractors, agreed per engagement.

  • Managed security programme support
  • Vulnerability management operations
  • SOC operations support
  • Security engineering and tool configuration
  • Compliance operations and evidence management
  • Security incident coordination
  • Dedicated or project-based specialists
  • MSP and security-team augmentation
Ways to engage

Assess. Build. Manage.

Most clients move through these in order, but you can start wherever you are. Every engagement starts with a free 30-minute call.

01

Assess

Understand your risk.

For organisations that need a clear view of where they stand.

  • Security posture assessment
  • Vulnerability and configuration review
  • Compliance gap assessment
  • Prioritised findings and risk register
  • Executive summary and remediation plan

Fixed-scope projects. Several can be reserved online.

02

Build

Establish and improve your programme.

For organisations ready to put structure and controls in place.

  • Security roadmap
  • Policies and procedures
  • Control implementation support
  • Incident response planning
  • Compliance readiness (SOC 2, ISO 27001, HIPAA)
  • Architecture recommendations

A tailored proposal with clear milestones.

03

Manage

Keep improving, month after month.

For organisations that want senior security support on an ongoing basis.

  • Fractional CISO leadership
  • Managed vulnerability management
  • Risk register and compliance upkeep
  • Remediation tracking
  • Incident response retainer
  • Monthly reporting and management reviews

One predictable monthly fee. Scope and response commitments agreed in writing.

  • Founder-led
  • ISACA CISM
  • US & EU
  • Reply within one business day