IT Security
Most security incidents start with something ordinary that nobody was watching. We keep patches, backups, access and certificates current on the systems we look after.
Security as maintenance, not as a project
Security is usually discussed as an event. An audit, a penetration test, a project with a start and an end. Those have their place, and they find things nothing else will. But the incidents that actually happen to ordinary companies rarely involve a clever attack on a well-maintained system.
They involve an unsupported plugin that had a public exploit for a year. A backup that had been failing silently since a disk filled up. An administrator account belonging to someone who left in 2023. A certificate that expired on a Sunday. None of these is exotic and all of them are the result of nobody being responsible for the boring, continuous part.
That continuous part is what this covers, for the systems we maintain. It is not a substitute for a proper audit. It is what prevents the ordinary problems that audits keep finding.
Backups you have actually restored
A backup is a claim about the future, and most such claims go unverified. The failure modes are consistent and unglamorous. The database is included but the uploaded files are not, so the shop restores with every product image missing. The retention window turns out to be shorter than the time it took to notice the problem. The job has been failing for weeks and the failure notification goes to a mailbox nobody reads. Or everything is technically fine, but the restore procedure has never been performed, so the first attempt happens under pressure with people waiting.
We treat a restore test as part of the work rather than as an optional extra. Recovery gets performed on a non-production environment, the steps get written down, and the time it takes is noted so you know what you are actually promising the business.
Patching, and the judgement it needs
Applying every update immediately is not a strategy, and neither is applying none. Both produce instability, just on different timescales.
The workable version has two tracks. Routine updates land on an agreed rhythm in small batches, which keeps each one easy to test and easy to blame when something moves. Anything with a known, relevant vulnerability jumps the queue.
The word doing the work there is relevant. A steady stream of advisories arrives for components in any modern stack, and a large share of them do not apply: the vulnerable code path is not one you call, or the configuration that triggers it is not one you use. Reacting to every announcement as an emergency exhausts the team and teaches them to ignore the next one. So the judgement is in triage, and it comes before the patching.
The things that quietly expire
A specific category of outage comes from dates. Certificates expire. Domains lapse. API keys are issued with a lifetime nobody noted. Cloud provider credits run out. A payment card attached to critical infrastructure passes its expiry date.
These are entirely preventable, and they are among the most common causes of a business waking up to a site that no longer loads. Tracking renewal dates and holding them somewhere other than one person's calendar is not sophisticated work, but it removes a real class of failure.
The same applies to access. People join, change roles and leave, and permission tends to accumulate in one direction unless someone reviews it deliberately. We tie that review to the events that change it, because access reviews scheduled in the abstract are the first thing dropped in a busy month.
Where this ends and a deeper engagement begins
It is worth being clear about the boundary. This offering keeps maintained systems in a defensible state through routine work. It does not include penetration testing, adversarial review of your application logic, network segmentation design, endpoint management across a fleet of laptops, or a formal disaster recovery plan with agreed recovery targets.
Those are real needs for some companies, and they belong to our cybersecurity service rather than here. If the baseline work surfaces something that needs that depth, we will say so plainly rather than stretch routine maintenance to cover a gap it was never shaped for.
What you get
Backups that have been restored
Automated backups of databases, files and configuration, plus periodic restore tests, because a backup nobody has recovered from is an assumption rather than a safeguard.
Dependency and system patching
Libraries, frameworks, container images and system packages are checked against known vulnerabilities and updated on a rhythm, with the urgent ones pulled forward.
Certificate and domain renewals
TLS certificates, domain registrations and DNS records are tracked and renewed before they expire, which removes one of the more embarrassing categories of outage.
Access hygiene
Accounts, roles and API keys are reviewed as people join and leave, so permission does not quietly outlive employment.
Secret storage and rotation
Credentials live in a password manager or a secrets store rather than in repositories and chat threads, and are rotated when someone with access moves on.
A short risk picture
A plain list of where your exposure actually sits and in what order it is worth addressing, so security spending follows evidence rather than anxiety.
How we work
- 01
Establish the baseline
We check what is exposed to the internet, what versions are running, where the data lives, who has access, and whether the backups exist and work.
- 02
Fix the obvious first
Publicly reachable services on unsupported versions, missing backups, credentials in repositories and admin accounts belonging to former staff come before anything sophisticated.
- 03
Set the patching routine
We agree how routine updates land and how urgent ones are handled outside that cycle, then run it, so patching stops depending on someone remembering.
- 04
Test the recovery path
Restores are performed on a non-production environment and the steps written down, so recovery is a documented procedure rather than an improvisation under pressure.
- 05
Review after changes
New integrations, new environments and staff changes each shift the exposure, so the access review and the risk picture are updated alongside the change.
Tools and technology
Where a solid open-source tool exists, we choose it over a closed one. No lock-in to a single vendor, and costs you can actually predict.
- Renovate
- Trivy
- OWASP ZAP
- Restic
- pgBackRest
- Wazuh
- Let's Encrypt
- Docker
- Dependabot
- Cloudflare
- 1Password
- Sentry
Frequently asked questions
More services in this category
Infrastructure organization
Infrastructure that grew one urgent decision at a time is hard to change safely. We map what you actually have, retire what nobody owns, and write down the rest.
Service management and environment configuration
Most outages start as configuration that drifted quietly out of date. We keep your environments consistent, updated and described well enough that changes stop being a gamble.
Support for existing solutions
Not every system needs replacing. Most of them need someone who knows how they work, keeps them updated, and fixes things before they become urgent.
Read testimonials from companies that trusted us
Delivered well ahead of the deadline.
ZanReal's individual approach is impressive.
Knowledge and business intuition make them a valuable partner.
Quick solutions that reduced costs by 99%.
Latest
Technical guides, security insights, and what we've learned building with AI.
Curious about what's next?
View all postsWhen did you last test a backup restore?
Message usTell us what your systems run on and what worries you most, and we will start with the basics: backups, patching, access and certificates.
Can't keep up with changes in AI world?
Let us do the heavy lifting. Every week we distill the most important AI developments into a focused 5-minute briefing — so you stay ahead without the noise.
Find out more