ServicesCibera Security
Security expertise when it matters
Hands-on incident response, Microsoft security operations and threat intelligence from engineers
who have run security operations centres and handled ransomware for banks, telecoms, pharma and the public sector.
15+years in enterprise IT and security
5working languages
1 dayreply time on business days
Technologies we work with
Microsoft SentinelMicrosoft Defender XDRMicrosoft Entra IDMicrosoft Purview
Palo Alto Cortex XSIAMIBM QRadar SIEM and SOARSplunkTaniumAzure
Active DirectoryKQL
Microsoft SentinelMicrosoft Defender XDRMicrosoft Entra IDMicrosoft Purview
Palo Alto Cortex XSIAMIBM QRadar SIEM and SOARSplunkTaniumAzure
Active DirectoryKQL
What we do
From the first alert to a stronger security programme
Pick one engagement or combine them. Every service can use Cibera OSINT intelligence about your organization.
Respond
Incident response and ransomware recovery
Containment, forensic investigation, eradication and recovery, with clear communication for leadership,
insurers and regulators while the incident runs.
- Ransomware and business email compromise
- Forensic timeline and root cause
- Crisis management and reporting
- Retainers with pre-agreed hours
Detect and operate
Security operations on the Microsoft stack and beyond
Deploy, tune and run Microsoft Sentinel and Defender XDR, write detections that find real attacks,
and automate the repetitive work.
- Managed detection and response
- Sentinel and Defender XDR deployment
- Detection engineering and KQL threat hunting
- SOAR playbooks: Sentinel, QRadar, Cortex XSIAM
- SOC design and transformation
Protect and comply
Identity, infrastructure and compliance
Close the gaps attackers use most: identities, Active Directory and unpatched servers, and show auditors
a plan that holds up.
- Entra ID, Conditional Access and MFA
- Microsoft 365 and Defender for Office 365
- Active Directory and Windows Server hardening
- Vulnerability management programmes
- NIS2, ISO 27001, NIST CSF and GDPR readiness
Threat intelligence
Managed intelligence powered by Cibera OSINT
Analysts watch leaks, ransomware claims, lookalike domains and dark web mentions of your organization,
and tell you what matters and what to do.
- Managed dark web and leak monitoring
- External exposure assessment
- Monthly intelligence briefings
- Integration with your SIEM
How we engage
Choose the model that fits
Project
A fixed scope and deliverables, such as a Sentinel deployment,
an Active Directory hardening or an exposure assessment. Quoted up front.
Retainer
Reserved incident response and engineering hours each month,
agreed contacts and response times, and a playbook prepared before you need it.
Fractional security lead
Part-time senior leadership for your security
strategy, tooling decisions, SOC build-out and team development.
Why Cibera Security
Experience from the inside of large security operations
Operators, not slidewareWe have led security operations centres and incident response teams, and moved them to modern, automated operating models.
Regulated industriesBanking, telecommunications, pharmaceuticals, healthcare and public sector environments with strict security and compliance needs.
Five working languagesEnglish, Portuguese, Czech, Polish and Spanish, so your team and your regulators are briefed in their own language.
Intelligence built inEvery engagement can draw on the Cibera OSINT platform for evidence about threats to your organization.
01Talk
A free 30-minute call to understand your situation and priorities.
02Propose
A written scope, timeline and fixed or capped price.
03Deliver
Hands-on work with regular updates and a clear handover.