中文
Menu

Service 02

Cybersecurity

Security work should leave you with fewer real risks and a clearer picture, instead of a longer report and more anxiety.

Overview

Protect what matters, in the order that matters.

No organisation can defend everything equally. Good security begins by understanding what you have, what would really hurt if it were lost or exposed, and how an attacker would be likely to reach it.

From there the work is often unglamorous and highly effective: strong identity, sensible segmentation, timely patching, reliable backups, useful logging and people who know what to do when something goes wrong.

We test only with your written authorisation and an agreed scope. Findings come with practical fixes and a ranking based on your context, so your team can begin somewhere sensible on Monday morning.

What we do

Finding, fixing and preparing.

  • Security posture assessment

    A structured review of identity, endpoints, networks, cloud configuration, data and processes, with a prioritised improvement plan.

  • Penetration testing

    Authorised testing of web applications, APIs, internal and external networks and cloud environments, followed by retesting of fixes.

  • Zero-trust and identity

    Phishing-resistant authentication, least-privilege access, device posture and segmentation, introduced in stages your staff can absorb.

  • Cloud and infrastructure hardening

    Configuration baselines for AWS, Azure, Google Cloud, Kubernetes, Linux and Windows, aligned to CIS Benchmarks where appropriate.

  • Secure development

    Threat modelling, secure code review, dependency and secret scanning, and security checks that fit naturally into delivery pipelines.

  • Logging and detection

    Deciding which events matter, collecting them centrally and writing alerts that someone can realistically act on.

  • Incident readiness and response

    Response plans, tabletop exercises and hands-on help with containment, evidence preservation and recovery.

  • Governance and compliance readiness

    Practical support for the Privacy Act 2020, NZISM, ISO/IEC 27001 and NIST CSF. We help you prepare; certification itself comes from an accredited body.

How it runs

How a security engagement runs.

  • 01

    Scope and authorise

    We agree the goals, systems, timing and rules of engagement in writing before any testing begins.

  • 02

    Understand

    We identify key assets, likely threats and the controls that are already doing useful work.

  • 03

    Assess

    We combine configuration review, testing and conversations with the people who run the systems.

  • 04

    Prioritise

    We rank findings by real-world likelihood and impact, with effort estimates for each fix.

  • 05

    Fix and verify

    We can work alongside your team on remediation, then retest to confirm each issue is really closed.

What you receive

Findings you can actually act on.

  • A plain-language summary for leadership
  • Technical findings with evidence and steps to reproduce
  • A prioritised remediation roadmap with effort estimates
  • Hardening baselines and configuration guidance
  • Incident response plan and contact tree
  • Retest results confirming which issues are closed

A good fit when

When this service tends to help.

  • A customer, insurer or auditor has asked for evidence of security
  • You have never had an independent look at your exposure
  • You are launching a product that handles sensitive information
  • You had a near miss, or an incident, and want to prevent another
  • Your team knows what needs doing but needs help with priorities

Questions

Things people usually ask

Will a penetration test disrupt our systems?
We plan to avoid disruption by agreeing scope, timing and off-limits actions in advance. Any testing carries some risk, so we discuss it openly and can use non-production environments where suitable.
How is a penetration test different from a vulnerability scan?
A scan automatically flags known issues. A penetration test adds human judgement, chains weaknesses together and shows what an attacker could actually achieve. Read more in what a penetration test tells you.
Can you certify us for ISO 27001?
No. Only an accredited certification body can do that. We can help you prepare the controls, evidence and habits that the audit looks for.
We think we have been breached. What now?
Email us with what you are seeing, and avoid rebuilding or wiping affected machines until evidence has been considered. If personal information may be involved, you may also have obligations under the Privacy Act 2020.

Other services

Start a conversation

Tell us what you are trying to do.

A few plain sentences are enough. Send us the problem, the deadline if there is one, and what has already been tried. We will tell you honestly whether we are the right people to help.

Get in touch support@vnet.nz