Cybersecurity services for businesses

Security included

You have security. But what exactly do you have?

Almost every company has antivirus and believes that covers it. Ask what happens when someone signs in to a company computer at three in the morning, and what usually follows is a pause.

Security is not a product you buy once. For the companies we run, the answer has five layers. We set them up, we watch them, and we are the ones who answer when the alarm goes off.

What changed in Romania over the past year

These are not our numbers. They come from the annual report of the National Cyber Security Directorate for 2025, published in August 2026.

+353% Compromised accounts

From 248 cases in 2024 to 1,125 in 2025. The Directorate puts the rise down to reused passwords and missing two-step sign-in.

+71% Phishing

Up 70.6%, to 4,975 incidents, which is 36% of everything reported. It has become the main way attackers get in.

+153% Ransomware

256 major incidents. Among the victims, 119 companies and 22 public institutions.

+91% Fraud

3,937 cases. One company in the defense industry lost more than 20,000 euros in a single incident.

One detail from the report is worth reading twice: phishing messages are now written in correct Romanian and convincingly imitate the visual identity of real organizations. The advice everyone repeats, that you spot them by the spelling mistakes, no longer works.

Source: the 2025 activity report of the National Cyber Security Directorate, public version, approved by CSAT Decision no. 117 of 7 August 2026.

What we put on top of your IT, layer by layer

Each layer catches something different. What one misses is exactly what the next one covers. Under each layer you will also find what we do, specifically, at that level.

Antivirus looks at files

It recognizes a dangerous file because it has seen it before. It stops known ransomware and programs already catalogued as harmful.

What it sees

Infected files, programs known to be dangerous, downloaded attachments.

What it misses

An attack with no file at all. If someone signs in with a stolen password and uses the programs already on the computer, antivirus has nothing to recognize. And the email that delivered the password looks flawless: the Directorate reports that phishing messages are now written in correct Romanian.

Our part We install it on every new device from day one, check monthly that it is running everywhere, and reinstall it when someone turns it off. We do not ask you to check.

Layer 02 covers this gap

Endpoint detection looks at behavior

It does not ask whether a file is dangerous. It asks whether what is happening makes sense right now, on this computer, at this hour.

What it sees

A remote access program opening a connection to an address in another country, at three in the morning, on the bookkeeper's computer. No file is infected. The action makes no sense, and the machine is cut off from the network within seconds, automatically.

What it misses

Nothing, as long as somebody actually looks at what it reports. Without the next layer, the alert lands in a mailbox nobody opens until morning.

Our part We establish what normal looks like in your company, so machines are not isolated for nothing. An accounting program sending data to the tax authority is not an alert. We do that tuning in the first month and adjust it as we go.

Layer 03 covers this gap

Managed detection means somebody is actually watching

A security operations center follows the alerts around the clock, in shifts, including at night and at weekends.

What it sees

Analysts confirm whether the alert is real, how far the attacker got and what needs to happen next. Our average from alert to response is under ten minutes.

What it misses

Everything that does not happen on a device. An attacker who walks straight into the email account, with the correct password, never touches a computer.

Our part We are the contact who receives the confirmed alert. We decide what gets stopped, who we call in your company and in what order. You get one explanation, not three reports from three suppliers.

Layer 04 covers this gap

Identity detection looks at accounts, not at computers

Included for every client we run, not as an option bought separately. It is also the layer that became the most necessary: compromised accounts rose by 353% in Romania in a single year.

What it sees

Someone signs in to Microsoft 365 from another country, at four in the morning, with the correct password, taken by a phishing email three weeks earlier. They create a rule that quietly moves every email containing the word "invoice" into a hidden folder. Then they wait.

What it misses

Nothing on the detection side. But detection stops the attack, it does not repair what is left behind. The isolated computer is still isolated, and the person who worked on it cannot work.

Our part We run your Microsoft 365 environment, so we are the ones who see the hidden rule, delete it, reset the account and check what left it. Without you opening any console.

Layer 05 covers this gap

We put the company back on its feet

Isolation stops the attack. But the computer stays disconnected, and the employee who worked on it has a blocked day. This is where any detection supplier's job ends and ours begins.

What we do

We clean the machine, reconnect it, check what the attacker managed to touch, and give the employee their working day back. Then we write down what happened and what we changed, so it does not happen again.

Why it matters Anyone can resell detection. The hard part is what comes after: someone who knows your company, knows what each person works on, and stays with them until they are back at work. We have been doing that for 25 years.

This is where the chain closes

A Tuesday night at a company we run

The same attack, minute by minute, through all five layers.

With the five layers Without