Defensive Security

End-to-End Security Solutions

Beyond the pentest. We become your security team — monitoring, advising, training, and responding 24/7.

MANAGED SERVICE

Security Operations Center (SOC-as-a-Service)

Most SMEs can't afford an in-house SOC team. We give you enterprise-grade 24/7 threat detection, incident triage, and response — at a fraction of the cost.

Powered by SIEM integration (Splunk, Microsoft Sentinel, Elastic), threat intelligence feeds, and staffed by analysts who've done real red team ops — not just read the playbook.

Request SOC Proposal
  • 24/7 Alert Monitoring & Triage
  • SIEM Deployment & Tuning (Splunk / Sentinel)
  • Threat Hunting & Anomaly Detection
  • EDR Management (CrowdStrike, SentinelOne, Defender)
  • Monthly Threat Intelligence Reports
  • Incident Escalation & Response Playbooks
  • Kenya DPA & Regulatory Alert Mapping
  • Dedicated Analyst Slack Channel

Who needs a vCISO?

Series A–C startups, SMEs scaling fast, companies with compliance mandates (ISO 27001, PCI DSS, SOC 2) but no budget for a £200k/year CISO.

Engagement Model

Typically 2–4 days/month. Attends board meetings, leads security committee, owns your security roadmap. Fully remote or on-site in Nairobi.

ADVISORY

Virtual CISO (vCISO)

Get a seasoned Chief Information Security Officer embedded in your leadership team — without the full-time executive salary. Strategic security leadership at a fraction of the cost.

  • Security Strategy & 3-Year Roadmap
  • Board & Investor Security Briefings
  • Security Budget Planning & Tool Selection
  • Vendor Risk Management Program
  • Policy & Procedure Development
  • Staff Awareness Program Design
Engage vCISO
COMPLIANCE

Governance, Risk & Compliance (GRC)

Navigate the complex web of cybersecurity regulations without losing your mind — or your certification.

ISO

ISO/IEC 27001

Gap analysis, ISMS design, policy templates, and audit readiness. We've shepherded clients from zero to certified.

PCI

PCI DSS v4.0

Scoping, QSA preparation, penetration testing required by PCI DSS 11.3, and remediation support for merchants and service providers.

CBK

CBK Cybersecurity Guidelines

Central Bank of Kenya compliance for licensed financial institutions — risk framework alignment, reporting templates, and supervisory examination prep.

KDPA

Kenya Data Protection Act

ODPC registration support, Data Protection Impact Assessments (DPIAs), privacy policy audits, and breach response procedures.

Cloud

SOC 2 Type II

For SaaS companies. Trust Services Criteria mapping, control implementation, and evidence collection for auditor review.

Africa

GDPR / Cross-Border

For East African businesses handling EU data. Lawful basis mapping, SCCs, DPA agreements, and Article 32 technical measure documentation.

TRAINING

Security Awareness & Technical Training

Your employees are your biggest attack surface. Our training programs turn them into your strongest defense layer — from the receptionist to the senior developer.

Request Training Proposal

Staff Phishing Simulation

We run real phishing campaigns against your team (with consent) and provide individual-level reporting with targeted remediation coaching.

Secure Development Training

OWASP Top 10 hands-on workshops for developers. Real code review, real exploitation demos, real fixes. For web, API, and mobile teams.

Executive & Board Briefings

Plain-English cybersecurity briefings for C-suite and board members. Helps leadership understand risk in business terms and make informed decisions.

EMERGENCY

Incident Response

Breached? We respond fast, contain damage, and get you operational — then make sure it never happens again.

Breach Containment

Rapid triage and isolation of compromised systems. We cut off attacker access and prevent further lateral movement within hours of engagement.

Digital Forensics

Memory capture, disk imaging, log analysis, and timeline reconstruction. We find out exactly what happened, when, and how — preserving court-admissible evidence.

Ransomware Response

Ransomware negotiation advisory, decryption feasibility assessment, backup recovery coordination, and post-incident hardening.

Post-Incident Review

Root cause analysis, full attack chain reconstruction, and a prioritized remediation roadmap so the same breach never happens twice.

! Under active attack? Email engagements@fugusan.com or call our incident hotline. Response within 2 hours.