It starts with a ninety-minute readiness review, on site or over Teams, working through the five controls against what you actually have rather than what the asset register says you have. Firewalls and routers, secure configuration, user access control, malware protection, and patching within fourteen days for anything rated high or critical. Almost every organisation fails something on the first pass, and the most common by a distance is patching — not servers, which people watch, but the laptop belonging to whoever is on maternity leave and has not been switched on since October. You get a written remediation list, ordered by what will fail you and what merely ought to be better, and however long you want to work through it. When you are ready we complete the submission together and verify each answer before it goes to IASME. The certificate lasts twelve months and, if you stay with us, the renewal is included in the retained fee rather than charged again at full price.

The agent goes on in an evening, takes about four minutes a machine, and you will not notice it afterwards. From then on Rowan sees what it sees. In a typical month across ninety clients the monitoring raises somewhere north of two thousand alerts; roughly forty are worth a human look, and three or four are worth ringing somebody about. That ratio is the entire product. Anybody can sell you a console that shows two thousand alerts — the work, and the reason it costs £14 a device rather than £4, is a named person deciding which four matter and then explaining them to you in a sentence rather than a dashboard. When something genuine happens you get a phone call, not a ticket. When it is out of hours and you are retained, you get a phone call within an hour, and the median over the last two years has been nineteen minutes.