01
Monitor
- What your company exposes to the internet, reviewed
- Email and cloud alerts, handled
Deliverable: At the frequency set in the plan
For companies without an in-house security team · Virtual CISO: who leads your security
Managed security program: your outside cybersecurity team
We work with your IT team to prioritize risks, carry out what was agreed and follow up on open items. Every month we show you what was done, what is still open and what needs your decision.
Free 30-minute consultation. We reply during business hours.
8 clients with more than 2 years of continuous relationship.
Pralogy is a cybersecurity firm that acts as the outside security team for companies without one. With an annual plan tailored to you, and alongside your IT team, we test your systems, monitor what you expose, lead compliance with a virtual CISO and respond if something happens. Every month, a report shows the progress.
Who follows security issues through until they are resolved?
Your company may have an IT person, security tools and tests already done. Even so, someone has to review alerts, coordinate fixes, verify changes and answer clients and auditors.
“We have security recommendations, but following up on them is hard.”
“Our IT person handles everything, and these issues keep getting postponed.”
“A client asked for a security report in their format, and we meet with them next week.”
“The auditor left us a finding and we are not sure how to respond.”
“We are getting ISO 27001 certified and have no one to run the management system.”
“We bought security tools, but we do not know how they are being managed.”
“We were attacked and do not want to start from scratch again.”
With a managed security program, that work has a plan and a team. We agree with you on what to address first and what we take on. Every month you see what was done and what is still open.
Request a free 30-minute consultation
Free 30-minute consultation. We reply during business hours.
Caso documentado
This is what one month looked like
In the managed security program we documented, we scanned the external attack surface every week. The client is a software company. In one month, we also:
- Reviewed the antivirus report for their computers.
- Ran a security awareness campaign for their staff.
- Handled cloud and email alerts.
- Answered requests from their clients.
- Moved a penetration test forward.
- Delivered the report with progress against the plan.
In that program, logged work ranged from 35 to 72 hours per month, over two consecutive months.
This is a real case. Activities and their frequency are agreed in each plan.
And this is the year in that same program
Every week
We review what the company exposes on the internet.
Every month
We deliver a report with what we did, the hours and the progress against the plan.
Every two or three months
We train the staff.
Every year
We test the applications the way an attacker would, review the controls and retest what was fixed.
If something happens
We already know your environment.
Each plan is built around your company. In other programs, the frequency is different.
The report lets you follow the work
It records the activities, the hours and the progress against the plan. You see what was addressed, what is still open and what needs your decision.
Illustrative example — Fictitious data. Shows the structure of the report.
Monthly summary
This month the penetration test of the main application moved forward, email alerts were handled and a client's security questionnaire was answered. Needs your decision: the date of the phishing test.
Progress against the annual plan62%
Illustrative example — Fictitious data. Shows the structure of the report.
Activities and hours
| Activity | Hours |
|---|---|
| Weekly external attack surface scan | 6 h |
| Antivirus report review | 3 h |
| Awareness campaign | 4 h |
| Cloud and email alerts | 8 h |
| A client's security questionnaire | 5 h |
| Penetration test in progress | 16 h |
| Total | 42 h |
Illustrative example — Fictitious data. Shows the structure of the report.
Open items
- Retest what was fixed
- Review the controls agreed with your IT team
Illustrative example — Fictitious data. Shows the structure of the report.
Next steps
- Staff training
- Phishing test
- Delivery of the penetration test report
What would your company's plan look like?
Tell us what your client, your auditor or your operation requires today, and we will tell you where to start.
Free 30-minute consultation. We reply during business hours.
Before you sign, you know what we take on
First we talk about what you need. Then we define the scope and send you a written proposal: the modules, what Pralogy takes on, what we coordinate with your IT team, the frequency and the duration.
- It is built in modules: we start with what your client, your auditor or your operation requires, and add the rest later.
- Every month you receive a report with what was done, what is still open and the progress against the plan.
- For managed security program clients, the contract includes a response within 8 business hours at most and 24/7 forensic response.
- 12-, 24- or 36-month contracts, billed monthly and by module. The details are in the proposal.
Virtual CISO and team: who does the work
Virtual CISO (vCISO)
Leads your security without being on staff: risk, policies, compliance, ISO 27001 and auditor relations. Works by the hour within the plan.
Testing specialists
Penetration testing, ethical hacking, secure code review and retesting of what was fixed.
Security analysts
Review of what is exposed to the internet, cloud and email alerts, and emails reported by your staff.
Our engineering team handles your request. The virtual CISO does not run the tests: finding and fixing are kept separate on purpose.
How we solve it
A yearly plan, built around you
We start with an activity schedule and measure progress every month. These are the modules; you choose which ones to start with.
02
Test
Deliverable: We retest what was fixed
03
Comply
04
People
05
Respond
Deliverable: And every month, the progress report
Real cases · anonymized
A relationship of several years
Documented case
Financial sector organization
Several years
of relationship: successive contracts and an expansion to protect email across the whole organization
Our promise
You run your business. Your security is our responsibility.
It stops being something you have to chase. We take it on, we handle it and we stand up for you.
We take responsibility
We manage and watch over your security. We only bring you what needs your decision.
We answer to third parties
If a client, an auditor, your insurer or a regulator asks about your security, we answer and stand by you.
We protect continuity
If something happens, we already know your environment. We act to keep your operation running.
How we do it
- When your client asks for a security report in their format, we prepare it and join you at the meeting.
- If an auditor leaves you a finding, we review it, reproduce it and help you respond with evidence.
- If an incident involves personal data and you have to report it to a regulator, we provide the technical support and the forensic report; your attorney handles the legal side.
- If you need to file a claim with your insurer, we deliver the forensic report, with the timeline and the facts kept separate from the hypotheses.
Frequently asked questions
What does the managed security program include?
A yearly plan with testing, governance and compliance, training and response. The modules and their frequency are agreed with you. See the modules.
Which companies is it for?
For companies and organizations without an in-house security team: for example, software companies that sell to enterprises and financial institutions, or companies where one IT person handles everything.
What do I receive every month?
A report with what we did, the hours per activity, the progress against the plan, what is still open and what comes next. See the sample report.
What is a virtual CISO?
The person who leads your company's security without being on staff: risk, policies, compliance and auditor relations. A virtual CISO works by the hour within the plan and does not run the tests. See who does the work.
Does it replace our IT team?
We work with them: they keep running day-to-day operations, and we bring the security roles in the plan. Every month you see what was done, what is still open and what needs your decision.
Why not hire a security person?
You can, and we will work with them. One person can hardly cover testing, cloud, email, training, compliance and incidents. The program gives you a team with separate roles: virtual CISO, testing specialists and analysts.
How much does the managed security program cost?
It depends on the modules and the size of your company. First we talk in the free 30-minute consultation; then we define the scope and send you a written proposal.
How long is the contract?
12-, 24- or 36-month contracts, billed monthly and by module. The details are in the proposal.
Is it the same as a security operations center (SOC)?
They are different services. The managed security program is a team's ongoing work on your security: plan, testing, follow-up and a monthly report. Security monitoring (SOC) watches your systems' logs and is contracted separately.
Let's talk about your company's security
In 30 minutes we talk about how you handle security today and what your client, your auditor or your operation requires, and we suggest a first plan.
What happens next: we reply during business hours to set a time. If you want to continue, we define the scope and send you a written proposal.