Defence is a set of decisions.
Not a stack of products.
Cyber Defence is our security practice: establishing what is genuinely worth protecting, designing the architecture and controls that protect it, and rehearsing the response before it is needed rather than during.
Security spend is easy to justify and hard to evaluate.
A business can hold a full set of tools, a current certificate and a recent penetration test, and still be unable to say who would be called first, what they would be authorised to do, or where a compromise would stop spreading. Those are design questions. They are answered before a product is chosen, not after.
Two questions decide most of it. What are we actually protecting — and who acts when this alerts at three in the morning.
Five stages.
Establish.
What matters, and what you are obliged to protect.
Assess.
Test it, rather than accept the documented position.
Design.
Architecture, controls, identity and detection.
Implement.
With our own specialists or a named technology partner.
Rehearse.
An incident exercise with the people who would actually be on the call.
Signs you need it.
If two or more of these are true, the tooling decision is premature.
- Nobody can say who would be called first at three in the morning.
- Tooling has been bought, and the alerts are not reviewed.
- Leavers keep access.
- A certificate expiry has caused an outage.
- A customer or regulator questionnaire cannot be answered honestly.
- A penetration test report is eighteen months old and findings are still open.
- A cyber insurance renewal is asking for evidence that does not exist.
What this is not.
Cyber Defence is not a product shortlist, and not a certification exercise on its own. Nor is it monitoring bolted on before anyone has decided what to protect: we can run 24/7 security monitoring as a separately priced service, scoped once the design says what it should watch.
Start with the two questions.
What are you protecting, and who acts when it alerts. If you cannot answer both, the tooling decision is premature — and that is a short conversation, not a programme.
Speak with Toga