How is this different from buying security software?

Tools are the easy part. Foundry Secure is the continuous management of your security posture inside the environment we already operate: the controls are configured, monitored and responded to as part of running the technology, and the evidence that they are on is kept. A product on its own does none of that.

We're a small business. Do we really need this?

Small businesses are automated-attack targets precisely because attackers expect weak defences. Most breaches start with a reused password or a phished login, and the controls on this page exist to stop exactly those attacks, at sensible cost.

What if an employee clicks a phishing link anyway?

Layers catch it: MFA and Conditional Access stop the stolen password working, endpoint detection catches the payload executing, mail security pulls the message from other inboxes, and isolated backups mean even a successful ransomware run is a bad day rather than a closed business.

Will this make us compliant?

No supplier can make you compliant, and you should be wary of one that says so. What Foundry does is run controls designed to support the frameworks you care about, document them, and give you the evidence, so when an insurer, a client or a regulator asks how data is protected there is a clear answer. Interpretation of your obligations stays with you and your advisers.

Can you get us Cyber Essentials?

The Foundry security baseline is designed to line up with the Cyber Essentials controls, so certification is a by-product of running the environment properly rather than a separate project. Cyber Essentials Plus adds an independent technical audit, which we prepare you for.

Do you help with cyber-insurance and client security questionnaires?

Yes. Insurers and clients now ask specific questions about MFA, endpoint protection, backups, patching and access control. Because we run those controls, we answer with evidence rather than guesses.

Managed Cybersecurity, Security Controls & Compliance Evidence

Cybersecurity marketing is full of fear. Reality is simpler: most attacks succeed through a handful of paths, and those paths are closed by controls that have to stay on. The difference between a secure business and an insecure one is rarely the tools it bought; it is whether someone's job is keeping them configured, watched and responded to. Foundry Secure makes that someone's job, inside the same team that operates your technology.

Prevent → Detect → Respond → Recover

Every control we run sits somewhere in this loop, and every part of the loop is covered. Prevention alone fails eventually; recovery alone means you've already lost a week.

Stage	What we manage
Prevent	MFA and Conditional Access on identity. Secure configuration of Microsoft 365 or Google Workspace. Device encryption. Patch and vulnerability management. Email authentication (SPF, DKIM, DMARC) and DNS filtering. A business password manager rolled out and trained. Security awareness for your people.
Detect	Managed endpoint detection and response on every device. Security logging and alerting across identity, email and endpoints. Monitoring for impossible travel, new admin accounts, mail-forwarding rules and the other tells of a compromised account.
Respond	A defined incident response process, run by an engineer within support hours: isolate the device, revoke sessions, reset credentials, trace what happened, tell you what it means in plain English. Alerts raised outside those hours wait for the next support window.
Recover	Isolated, versioned, ransomware-resistant backups, including Microsoft 365 and Google Workspace, with restores tested on a schedule. See Foundry Cloud for Recovery Assurance.

Governance: controls you can evidence

Security that cannot be shown is not much use to a business that has to answer to an insurer, a client's procurement team or a regulator. Every control Foundry runs is documented with what it is, where it applies and when it was last verified, and the monthly report states the posture rather than asserting it.

You are asked	What you can answer with
"Do you have MFA on everything?"	Coverage by account, with exceptions listed and justified.
"Are your devices encrypted and protected?"	Enrolment, encryption and endpoint-protection status per device.
"Are backups tested?"	Last successful backup and last successful test restore, per system.
"Who has admin access?"	The named accounts, and the log of when privileged access was used.
"How do you handle a leaver?"	The same-day process, with the record that it ran.

We design these controls to support Cyber Essentials, cyber-insurance conditions and the information-security expectations that regulated sectors carry. We do not claim they make you compliant with anything; that judgement belongs to you and your advisers, and we give you the material to make it.

Security that doesn't slow you down

These controls are chosen because they barely interrupt anyone's day. Certificates renew themselves. Passwords autofill. MFA is one tap. Security that fights your team always loses; security that flows with it sticks.

Managed cybersecurity, built into how your technology runs