Security you can check rather than take on trust. We publish what we measure, including the parts that are deliberately not switched on and why.
Internal applications reach their users through an outbound tunnel. Nothing listens on a public address, so there is no inbound port to scan, no management interface to find and no firewall exception to explain. Access is decided per identity, not per IP address, and every session is logged.
Configuration is checked against recognised benchmarks rather than declared secure. Findings are triaged into three groups: real and fixed, inapplicable to the platform with a stated reason, or accepted with a compensating control. That deviation list is what an auditor actually wants to see — a bare percentage tells them nothing.
A SIEM collects logs across the estate: file integrity, process auditing on Windows, authentication events and firewall decisions. Alert rules are mapped to control frameworks so a finding can be traced to the requirement it satisfies. Reputation-based blocking runs in front of all of it, and we measure the rules actually loaded in the kernel rather than whether the service claims to be running.
TLS 1.3 is the minimum on every site we operate. Mail domains publish SPF, DKIM and DMARC at reject policy, with MTA-STS and TLS reporting. These are verifiable from outside our network by anyone who cares to look — which is the point.
Describe the workload and we will tell you what it needs — including when the honest answer is that you do not need us for it.