About Defendrs
One firm that answers for both your IT and your security.
Some of our clients hand us everything: IT, security, the lot. Others like their current IT people and bring us in for security or compliance alone. The arrangement differs. What stays the same is that one company is on the hook for the outcome.
A 30-minute call. Straight answers. A short list of what to do next.
Why this is hard
Everyone involved in your technology has a reason security is someone else’s department.
The help desk responds to tickets. Software vendors secure their own applications and stop there. Your insurer mails a questionnaire. A regulator asks for documentation. Contractors need access, and employees work from the office, the kitchen table, and airport lounges.
Somewhere in the middle sits the owner, assuming the pieces add up to a business that is protected. Usually nobody has checked.
Checking is our job, and so is closing whatever the check turns up.
How Defendrs came about
Break-ins are rarely clever. Most of them trace back to something dull: an account still active for an employee who quit months ago, a password recycled across half a dozen sites, a laptop that quietly stopped installing updates and that nobody thought to look at.
There was almost always a vendor standing near the problem. It just was not in their scope. After the fact, each one can point to a contract that proves it, and each one is correct. That is cold comfort to the company whose files are gone.
Defendrs was started to own the things that fall outside everybody else’s scope. We take the whole environment as our responsibility, which means finding the risk, fixing it, and making sure it stays fixed while your business changes around it.
What we believe
Security should fit what is at stake
A tax practice, an oil and gas operator, and a fabrication shop doing defense work do not share the same threats or the same regulators. We build each client’s protection around the data they hold and the way they actually work. Nobody gets a standard bundle.
Policies should describe what really happens
A written policy earns its keep when it reflects controls that exist and that people follow. A shelf of rules nobody observes stops nothing, and after a breach it becomes a record of what you said you would do and did not.
You cannot separate IT from security
Issuing a laptop, creating an account, managing email, and running backups are everyday IT tasks. Every one of them is a security control too. Split them among different vendors and the handoffs become the soft spots.
A finding only counts once it is fixed
A long report that goes unread protects no one. We consider the job done when you know what gets fixed first, why it is first, and the date it will be finished.
How an engagement runs
Understand the business first
The opening conversation is about how you make money and what could interrupt it. We do not arrive with a product list. When we do recommend something, you will know exactly which risk it addresses.
Put the problems in order
We sort what we find by how much damage each item could do. You see the entire list, top to bottom, with the reasoning, and you decide how fast to move.
Fix things ourselves
We install the protections, draft the policies, and run the monitoring. Advice that stays in a presentation changes nothing about your exposure.
Check back on a schedule
People, vendors, and software change constantly. We review your environment at regular intervals so the protection you paid for last year is still doing its job this year.
Talk to people who will look after your business as if they owned it.
Half an hour in plain English. You will hear where you actually stand, including the parts that are fine as they are.