Security automation · SecOps
Security automation that runs itself.
Technical security implementation and SecOps automation, with a written scope and milestones: directly for you, or as a subcontractor to your consultancy.
Last updated: 22 August 2026
Engagement models
The same work, in two contract setups.
For end-user companies
Direct engagement
An audit finding, a remediation plan, or more alerts than the team can handle: we build it in your environment, document it, and your operations team runs it from there.
For consultancies and system integrators
Subcontracting
An assessment or compliance project that needs its technical delivery. We deliver it as a subcontractor, under your name; the client relationship stays yours.
What it means concretely
Six areas where automation pays back immediately.
Alert triage and enrichment
Before
Every alert reaches a human, and most of the day goes on ruling out false positives.
After
Alerts get context automatically: asset owner, vulnerability state, previous occurrences, threat intel. Only real decisions reach a person.
Log pipelines and detection tuning
Before
Everything goes into the SIEM, cost climbs, and the signal drowns in the noise.
After
A log flow filtered, normalised and routed at the source, with tuned detection rules. Less stored data, more usable alerts.
Evidence collection for audits
Before
Before every audit, someone spends two weeks collecting screenshots and exports by hand.
After
Evidence generates on schedule and lands versioned in storage. When the auditor arrives it is already there, and it will be there next cycle too.
Access reviews
Before
The access review is a spreadsheet circulated once a quarter.
After
Automated collection, owner mapping and drift alerts: dormant privileged accounts, permission creep, logins bypassing MFA.
Configuration drift detection
Before
The system was compliant at handover; six months on there is no visibility.
After
Control state is measured continuously and drift raises an alert, so compliance holds over time.
Restore testing
Before
Backups run; restore testing is irregular.
After
Scheduled, documented restore drills with records: 3-2-1-1-0, with an immutable copy.
Frequently asked questions
Do you work as a subcontractor, or only on direct engagements?
Both. For consultancies and system integrators we deliver the technical work within your framework; the client relationship is yours, and an NDA is standard.
How much does an automation engagement cost?
The assessment starts from €1,200 fixed, in 2–3 days. A focused build of one automation area is from €2,500, full implementation from roughly €6,000 in milestones, and continuous controls monitoring from €700 per month. Day-rate billing is available for subcontracting.
What technologies do you build on?
Whatever the environment calls for: Splunk, Microsoft Sentinel, Wazuh, Elastic and QRadar on the SIEM side; Python, Bash and Ansible for automation. It builds on our founder's experience in a national telecom's SecOps environment and on OT/IT manufacturing sites.
Do we need to buy licences?
In most cases, no. We build on proven open-source components, and everything is yours: configuration, scripts, evidence pipelines, documented for your own team to operate.
Still wondering whether the regulation reaches you at all? Four questions settle it, and full NIS2 implementation has its own page. Past work and the full service list are on the home page.