Security Engineering

Security projects, delivered hands-on.

We design, implement, configure and migrate security tooling across endpoints, servers and the wider security stack. From Microsoft Defender, Intune and App Control through to WAF, DDoS protection and wider security tooling, we provide senior engineering capacity to take projects from design and testing through to rollout and handover.

Discuss your project

The problem

Security tooling is often implemented under time pressure and then left to drift. Policies change, exceptions build up, products overlap and projects stay on the backlog because internal teams don't have the specialist capacity to deliver them.

This is for you if

You have a security project that needs experienced hands-on delivery.
Security tooling has been implemented but never properly tuned or reviewed.
You're running overlapping products and want to consolidate or migrate.
Exceptions, exclusions and legacy configuration have built up over time.
You need to introduce a new control without disrupting production systems.
Your internal team knows what needs doing but doesn't have the time or specialist resource to deliver it.

What we do

We take security engineering projects from design through testing, rollout and handover, working directly in the tools and environments your team uses.

Design controls around your environment and requirements, and test them before rollout.
Roll changes out in stages, working within your change and CAB processes.
Review exclusions, assignments and exceptions to identify gaps or overly broad configuration.
Rationalise legacy configuration during migrations so outdated policies, exclusions and exceptions aren't simply carried into the new platform.
Build or update detections around newly implemented tooling so the SOC retains visibility throughout the change.
Document the finished configuration and hand the capability over to your internal team.

Typical projects

Defender for Endpoint and Defender Antivirus implementation and hardening.
App Control for Business rollout.
Attack Surface Reduction implementation.
EDR, antivirus and security tooling migrations.
Intune security configuration.
Server security controls and hardening.
WAF implementation and tuning.
DDoS protection implementation and configuration.
Security tooling consolidation and platform replacement.

What you get

Security controls designed and configured around your environment and requirements.
Agreed changes taken through testing and rollout, working within your internal change processes.
Legacy configuration, exclusions and unnecessary overlap removed where appropriate.
Clear technical documentation, change records and handover to your internal team.

Results

£200k+annual saving through security tooling consolidationLegacy EDR, antivirus and application control were consolidated into the Microsoft security stack across 3,000+ endpoints, with no service disruption during cutover.Read the case study 1,000+endpoints brought under application controlCarbon Black App Control policies were designed, tested and tuned to prevent unauthorised software while allowing legitimate business applications to continue running.Read the case study

A good place to start

Want to review your Microsoft endpoint controls?

Microsoft Endpoint Hardening Review

typically 3-5 weeks

We review your endpoint security configuration across Defender for Endpoint, Intune, Defender Antivirus, Attack Surface Reduction and App Control for Business. This includes reviewing policy settings, exclusions and assignments to identify gaps, overly broad exceptions and controls that are not being applied as intended.

You get: a prioritised set of findings and recommended configuration changes, with a clear record of what should change and why. We can then implement the agreed improvements, or work with your internal team to action them.

Discuss a Microsoft Endpoint Hardening Review

Migrating or consolidating security tooling?

We can design and deliver the migration, rationalise existing configuration and manage the technical rollout.

Discuss your migration

Have a security engineering project to deliver?

Tell us what needs implementing, migrating or fixing and we'll scope the engineering work around your environment.

Discuss your project

Platforms and technologies

Our experience includes Microsoft Defender for Endpoint, Defender Antivirus, Intune, App Control for Business, Attack Surface Reduction, Microsoft 365 E5, Carbon Black App Control, Zscaler and other enterprise security technologies. We work with the tooling already in your environment and recommend changes based on the technical requirement rather than pushing a preferred product.

Frequently Asked Questions

What kinds of security engineering projects do you take on?

We work on the implementation, migration, configuration and hardening of security controls across endpoints, servers and the wider environment. This includes Microsoft security controls, EDR and antivirus migrations, application control, WAF and DDoS protection, as well as other security platforms where additional engineering capacity is needed.

Can we replace our existing EDR and antivirus with Microsoft Defender?

Often, yes, if you already hold Microsoft 365 E5 or the relevant Defender licences. The work is in the migration: understanding the existing configuration, rationalising legacy policies and exclusions, testing the new controls and planning the cutover so protection and SOC visibility aren't lost between platforms. We delivered this for a financial services client across 3,000+ endpoints, saving over £200k a year.

Will application control break our business applications?

It doesn't have to. We start in audit mode, use the data to understand the software your business relies on, then build and test policies before moving towards enforcement in stages. Exceptions are scoped as tightly as possible so unauthorised software is blocked without unnecessarily disrupting legitimate work.

Tell us what you're working on.

Whether it's a noisy SOC, detections you don't trust, an untested response plan or a security project that needs delivering, a short call is the quickest way to work out what to do next.

Talk to a security specialist

Free 30-minute call · No obligation · Speak directly with the person who'd do the work