Cybersecurity

How It Works & Technology Overview

Commercial security engagements stack four layers: endpoint (EDR agents detecting/containing on devices; MDR when a 24/7 SOC watches the telemetry), network (next-gen firewalls with UTM features — IPS, web filtering, application control — plus segmentation/VLAN design), identity (MFA, conditional access, privileged-access hygiene; the modern control plane is the cloud identity provider), and visibility/response (log aggregation/SIEM, alerting, incident-response runbooks). Engagements come in three shapes: posture assessment (find out where you stand), remediation/hardening (fix it), and managed security (monitor and respond, recurring). Drivers are usually external: a compliance framework, a client contract clause, a cyber-insurance renewal, or a recent incident.

Common Deployment Scenarios

• Risk/posture assessment: NIST-CSF-style review, vulnerability scan, report with prioritized remediation roadmap — often the entry engagement.
• EDR/MDR rollout: agent deployment across endpoints and servers, policy tuning, SOC onboarding; the first month is noise reduction.
• Firewall replacement/segmentation: rule migration, VLAN/zone design, UTM enablement sized against real throughput.
• MFA/identity hardening: MFA enforcement, conditional access baseline, service-account and shared-credential cleanup — an identity project, not a checkbox.
• Compliance-driven programs: CMMC/HIPAA/PCI gap assessment → remediation → evidence collection, with documentation as a first-class deliverable. CMMC requirements have been phasing into new DoD solicitations since November 10, 2025 — a defense supplier's deadline is set by a specific contract or bid, so ask which one.
• Incident response: containment, forensics, rebuild — unbounded until scoped; sold via retainer or T&M with clear boundaries.

Products, Vendors & Characteristics

• EDR/MDR: CrowdStrike, SentinelOne, Microsoft Defender for Endpoint (licensing-bundled with M365 E5-class SKUs), Sophos, Huntress and Blackpoint (MSP-oriented, strong at small/mid-market); MDR pricing is per-endpoint per-month.
• Firewalls: Fortinet FortiGate (UTM depth; enabling full inspection cuts rated throughput dramatically — size on inspected throughput, not WAN speed), Palo Alto (enterprise), SonicWall/WatchGuard/Meraki MX (SMB/mid-market, cloud-managed).
• SIEM/logging: Microsoft Sentinel (consumption-priced — log volume drives cost), Splunk, Elastic, Wazuh (open source); log-source onboarding is where deployment hours actually go.
• Email/DNS security: Proofpoint, Mimecast, Avanan/Check Point, Cisco Umbrella.
• Awareness training: KnowBe4-class platforms — 4–6 hours to stand up campaigns.
• Vulnerability scanning: Tenable/Nessus, Qualys, Rapid7 — scan is cheap; analysis and remediation guidance is the labor.

What Makes It Hard (Gotchas & Failure Modes)

• The human layer fails first. Security projects die on change management: users bypass controls, internal IT slow-walks access for outside reviewers (the gatekeeper pattern), executives demand exemptions from their own policies.
• Asset inventories are always wrong. Endpoint counts miss servers, printers, OT/ICS devices, and the legacy line-of-business box that can't run an agent — every uncounted device is unpriced work; compensating controls for un-agentable systems are their own design task.
• "Just turn on MFA" collides with shared credentials and service accounts that can't follow the normal flow — commonly 30% of accounts need special handling.
• Discovery vs. remediation blur. Finding problems is fast; fixing them is an operational mountain. Contracts that bundle them quote the mountain blind — keep separate SOWs and settle remediation ownership in writing.
• Detection tooling noise. Deployment takes an afternoon; tuning out false positives takes weeks. Untuned tools train clients to ignore alerts.
• Insurance attestations legally commit clients to controls nobody implemented; treat a signed renewal as a requirements document.
• Compliance documentation doesn't come with the platform license — evidence formats differ per framework and are separate labor.

Effort & Estimation Patterns

• Risk assessment (NIST-CSF-based), mid-size client: 3–5 days.
• Vulnerability scan + report: 1 day scan, 1–2 days analysis/reporting.
• Firewall replacement: 1–2 days straightforward; 3–5 days for complex rule sets/many zones; always include a maintenance window and rollback plan.
• EDR to ~50 endpoints: ~1 day deployment plus 2–3 hours/week tuning for the first month; MDR onboarding adds log-source integration time per source, not per endpoint.
• MFA/conditional-access baseline: 4–6 hours policy build + testing, plus per-exception handling for service/shared accounts; stage policies in report-only mode 7–14 days before enforcement.
• Gap assessments: HIPAA technical safeguards 2–4 days; CMMC 3–5 days scoping — remediation quoted after, never bundled.
• Reporting/advisory overhead: 20–30% of project labor on compliance-driven work; scope advisory hours separately from engineering hours.
• OT/ICS environments: +50% contingency and a mandatory site walk.
• Recurring: managed security prices per endpoint/user per month; include tuning reviews and quarterly reporting in the model, and price after-hours response explicitly.