I'm an incident responder who takes on a small number of fixed-scope engagements for small and mid-sized companies in the EU, UK and North America. Technical work only: your external attack surface, your logs, your endpoints and your detections, delivered as a clear report with fixes you can act on.
A review of your Microsoft 365 or Google Workspace audit logs for signs of account takeover, one of the most common ways small businesses get breached.
Unusual sign-ins: impossible travel, new countries, legacy protocols
Hidden inbox rules and forwarding to outside addresses
Risky OAuth app consents and token misuse
Accounts without MFA and gaps in audit logging
You getA clear verdict for every account reviewed, evidence for anything suspicious and step-by-step fixes.
A review of whether your logging, SIEM and EDR actually catch what matters, tested rather than assumed.
Which log sources you collect, and what is missing
Coverage mapped against MITRE ATT&CK
Safe test events to confirm your alerts actually fire
Tuning noisy rules so real alerts get seen
You getA coverage map, a gap list in priority order and ready-to-deploy rules (Wazuh, Sigma or your SIEM).
From €2,8002-3 weeks · One SIEM or Wazuh, up to 10 log sourcesAsk about this
Compromise assessment
Something feels wrong
A focused threat hunt across your endpoints and logs for signs that someone is already inside.
Endpoint triage collection across your machines
Persistence, lateral movement and unusual logons
Suspicious processes, services and scheduled tasks
Malware analysis of anything that turns up
You getA clear answer, a timeline of anything found, indicators of compromise and remediation steps.
From €2,2001-2 weeks after collection · Includes 20 hosts, +€30 per extra hostAsk about this
Dealing with an active incident? Tick "This is an active incident" in the form and those messages are read first. I'm one person, not a 24/7 response team. If you need round-the-clock help, I'll say so honestly and point you to someone who can.
Working towards NIS2 or DORA?
Every engagement leaves you with technical evidence (findings, test results and a record of what was fixed) that you can use towards the technical security measures these regulations expect.
I don't write policies or act as your compliance advisor. If you need that, bring your auditor or advisor in and I'll work alongside them.
What I don't do
Governance, policy writing or compliance sign-off
Ongoing retainers or a managed 24/7 SOC
Testing anything you don't own or aren't authorised to test
How it works
01
You describe the problem
Use the form below. A rough description is enough: size of the company, what you run, what worries you.
02
Scope and fixed quote
I reply with questions, then a written scope, timeline and price. We sign an NDA and a written authorisation before any testing.
03
The work
Remote, with short written updates. Anything critical is reported the same day, not saved for the final report.
04
Report and walkthrough
A prioritised report for your team and a one-page summary for management, plus a walkthrough and answers to follow-up questions.
See how I work before you write
Everything on this site is my own work. It's the best way to judge whether I'm the right fit.