Backstop Cyber — security engineering
Senior operators who plug into your team and take on the deep work there is never time for — hunting, detection engineering, adversary simulation, architecture, and security leadership. Scoped engagements with a start, an end, and artifacts you keep.
Three things are true in almost every environment we walk into. They are not failures of judgment. They are what happens when the work grows faster than the headcount.
Your tooling produces more findings in a day than your analysts can honestly work in a week. So triage quietly becomes sampling. The queue gets a haircut instead of an answer, and the handful of things that actually mattered get closed with the same two-word disposition as everything else. Nobody decided this. The arithmetic decided it.
Half the rules in your stack were written by a vendor for a generic environment. The other half were written by someone who has since left. Nobody has measured coverage against real technique behaviour in two years, and the log sources those rules depend on have been re-pointed twice since. The dashboard is still green — because it is measuring whether the pipeline is up, not whether it would catch anything.
Nothing here was built wrong. It was built for the company you were four acquisitions, two clouds and one identity migration ago. Every individual decision was locally reasonable and correctly signed off. The sum of them is a topology nobody can hold in their head — which means nobody in the building can tell you, with evidence, what an attacker who lands on a laptop can actually reach.
You do not need another platform. You need people who have done this specific work before, for a defined stretch of time, on the specific problem in front of you — and who leave the capability behind when they go.
Each of these is delivered as a scoped engagement. They combine well and they stand alone. If what you need is not on this list, we will say so and point you somewhere better.
We start from technique behaviour, not from vendor rule names. First we find out what is actually queryable in your telemetry — which is rarely what the data-sheet claims — then we map real coverage against the behaviours that matter for your environment and your threat model. Then we go looking by hand for the things your controls were never going to surface on their own. What comes back is a set of tested detections with documented logic, tuned thresholds and a false-positive profile we measured rather than guessed, plus the hunt notes showing exactly what we looked for and where the telemetry could not answer the question.
Full-scope testing against your production reality: external surface, identity, cloud control plane, endpoint controls and — the part that matters — the paths between them. We chain the boring individual findings into the ones that end at domain admin or your object storage, because that is how it actually goes. Every finding ships with the exact reproduction, the artefacts your detection team can write against, and a severity we can defend in a room full of your engineers. When your controls stop us, we write down precisely what stopped us and when you saw it. A test that only produces findings is not a test.
We draw the system as it actually is rather than as the diagram claims: trust boundaries, identity paths, egress, key material and every place where a control is assumed but not enforced. Then we work the list. Segmentation that survives contact with an auditor. Identity architecture that does not hinge on one over-privileged service principal nobody will admit to owning. Logging built for detection instead of for storage cost. You get the drawings, the decision records that explain why each call was made, and a sequenced plan your own team can execute without us in the room.
For teams that have the engineers but not the person who owns the programme. We take the seat: risk decisions with names attached to them, roadmap, budget defence, vendor and tool rationalisation, control framework mapping, and the part nobody enjoys — writing the policies and standards that hold up when an auditor or a customer's security questionnaire comes for them. Set hours, set scope, on your calendar. The goal is to make your team able to run this without us, not to become a permanent line item.
No open-ended retainers that quietly become a subscription. No surprises in week six. You know on day one what you are getting and when it stops.
01 — Scoping
We go through your environment, your telemetry, what you have already tried, and what "done" has to look like for this to be worth the budget. You leave with a written scope: objectives, boundaries, rules of engagement, what we will need from your team and when, and a fixed end date. If the honest answer is that you need something we do not do, you will hear it in that session rather than after the invoice.
02 — The engagement
We work the agreed scope during business hours on a set rhythm, with a standing check-in and a shared channel. Confirmed findings go to you as we confirm them — if something needs your attention on day three, you hear it on day three, not in week six. Scope changes get written down and re-agreed rather than quietly absorbed, because that is how engagements turn into resentment.
03 — Handoff
We walk your engineers through all of it in a working session, answer the awkward questions, and then the engagement ends on the date we said it would.
Knowing which lane you are in is most of the job. Here is ours, and here is plainly where it ends.
There is no logo wall here and no client list, because we are not going to put anything on this page that we cannot stand behind in a room. What follows is what is actually true.
Named in text rather than shown as badges. Certifying bodies do not endorse this firm, and a certification is a floor rather than a qualification to do the work.
Stated as categories, never as named clients. If your sector is not listed it does not mean we cannot help — ask in the scoping call.
Rough is fine. A paragraph describing the thing that keeps getting bumped down the backlog is more useful to us than a formal RFP.
Your first real conversation is a scoping session with the people who would do the work. There is no SDR in between.