We run the IT for 70+ companies in Romania, from ten-person firms to organizations with 300 employees. In all of them, cybersecurity comes in the same subscription as IT support, whether we take over the whole of IT or work alongside your internal team: five layers of protection that we set up, run and answer for, monitored around the clock.
A security tool that is installed and then left unwatched is just a screen full of alerts nobody reads. We take on exactly the part that is usually missing: setting up the five layers around how your company actually works, monitoring them around the clock, and stepping in the moment an alert turns out to be real.
All five are included in the subscription, not as a separate option. The last two in the table are optional and are added only if you ask for them. The same either way, whether you choose fully managed IT or co-managed IT, where we work alongside your internal team. Below you can see what each layer does and what the next one picks up.
No single layer sees everything: endpoint detection cannot catch email compromises or attacks using stolen credentials. Real-world attacks cross multiple vectors, requiring continuous, multi-layered defense.
Managed together, these five layers make up MDR (managed detection and response). Antivirus stops what is already known, the endpoint and identity sensors catch what has never been seen, and analysts triage the signals around the clock and act directly. The benchmark MDR services are compared on is MTTR, the mean time to respond: ours is 8 minutes from the alert to the attack being stopped. Cleanup and getting back to work come afterward, and take longer. The last two rows in the table are optional and are added separately, if you ask for them.
| Layer | What it sees | Analogy | Covered by the next layer |
|---|---|---|---|
| 01Files already known to be dangerousAntivirus |
What is already on the known-threat lists.
|
The list of known faces at the door. | Everything that has never been seen before. That is layer 02, which watches behavior rather than files. |
| 02What happens on the endpointsEDR · endpoint detection |
An agent on every machine, watching continuously.
|
The motion sensors inside the building. | Attacks that never touch a device. Layer 03 catches those, by watching accounts. |
| 03Who signs in to the Microsoft 365 accounts, and what they do nextITDR · identity detection |
Who signs in to the Microsoft 365 accounts, and what they do next.
|
The doorman who checks the badge on the way in and watches what the person does once inside. | The rest. Layer 03 blocks a suspicious sign-in and removes a hidden rule on its own, but the account is still compromised, and the other signals need confirming. An analyst at layer 04 confirms it is a real attack and locks the account. |
| 04Somebody watching, around the clockSOC · monitoring center |
The telemetry from layers 02 and 03, together, with 24/7 monitoring.
|
The dispatch room, staffed in shifts, around the clock. | The repair. The attack is stopped, but layer 05 cleans up, reconnects the machine to the network once the incident is closed, and explains what happened. |
| 05Somebody who comes and fixes itRisksoft |
What the attacker touched before being stopped.
|
The crew that turns up on site and puts everything back in order. | Nothing. This is where the chain closes, which is why it is last. |
| +Every log, in one placeSIEM · optional |
The records from Windows, the firewalls, the VPN and the other connected devices.
|
The front-desk register that keeps everything that happened. | It stops nothing on its own. It gives the analysts at 04 more sources, so attacks are seen earlier. Some, such as a VPN connection used to scan the network, show up only here. |
| +The people who click the linksSAT · Security Awareness Training · optional |
What your team does when a fake email arrives.
|
The fire drill: you run it so that it is not the first time when it happens for real. | It replaces no technical layer. It reduces the number of occasions on which the others have to step in. |
Endpoint detection is called EDR, endpoint detection and response. It continuously collects what happens on every machine: which processes start, which connections open, what launches what. It blocks clear patterns, such as a fileless attack, on its own, straight away, and raises the rest at once. The computer is isolated at network level only once an analyst confirms it is an attack. It stays powered on for investigation but reaches nothing. That is the difference between one infected computer and an infected network.
The human part is called MDR, managed detection and response. A tool left alone produces hundreds of alerts a day, most of them noise. What matters here is MTTR, the average time from receiving the alert to the attack being stopped. It does not include cleaning the machine, which comes afterward. It is not the same as time to detect: between them sits the triage a person does. Eight minutes means an attack that starts at three in the morning is stopped before daybreak. By the time the first employee reaches the office, the attack has already been stopped. This holds at any hour, including nights, weekends and public holidays.
Identity detection is called ITDR, identity threat detection and response. For example, it catches impossible travel, meaning two sign-ins from places too far apart to have traveled between, session key theft, meaning the ticket your browser keeps after you sign in, which bypasses two-step sign-in, and the new rules that hide or forward your email. It blocks a suspicious sign-in with a stolen password on its own, and removes a hidden rule straight away. The analyst confirms the other signals and locks the account.
Security is not a single product but several layers. Each one covers a different kind of attack, and what one misses the next one catches.
It takes a minute. You see what would happen to 10 common kinds of attack in your company. Nothing is sent anywhere, you are not requesting a quote, and we are not asking for your email.
Click anywhere on a row to tick it.
They cover two attacks the five layers above cannot see. Tap “Add” and see how your result changes.
SIEM (Security Information and Event Management) gathers the records from Windows, firewalls and VPN in one place, so the analysts see more.
Protects you from, for example: someone who signs in to the company VPN with a stolen password and looks for weak spots on the network. The traces sit only in the VPN and firewall records. SIEM brings them together, and the SOC analysts (layer 04) stop the attack.
SAT (Security Awareness Training) means short monthly training and phishing simulations, so people spot a fake email before they click.
Protects you from: a fake invoice sent from a supplier’s real address, with a new bank account. It comes from a legitimate account, so no system has anything to raise. It is stopped by the person who calls the supplier before paying.
Tick at least one layer above to see the result.
EDR or ITDR blocks the action on its own, but without the SOC (layer 04), the analysts monitoring alerts around the clock, nobody closes the attacker’s way in.
A fake email leads to a page that looks exactly like the Microsoft 365 sign-in page. The employee types their password there, and the attacker tries to sign in with it, from another country or another device. Identity detection (03) sees that the place, time or device does not match the account’s habits and blocks the sign-in on its own. The attacker still has the password, though: the monitoring analyst (04) confirms the attack, locks the account until the password is changed, and checks whether the attacker got in anywhere else.
The employee signs in on a fake page that forwards the two-step sign-in code and keeps the session key. From then on the attacker gets in with no password and no code. Identity detection (03) sees the session used from somewhere else, and the monitoring analyst (04) revokes it.
The attacker gets into your account and adds a rule that automatically moves any message containing the word “invoice” into a hidden folder, so they can reply in your place and send the client a different bank account. It touches no computer, so endpoint detection (02) has nothing to report. Identity detection (03) recognizes the rule and removes it on its own, straight away. The account is still in the attacker’s hands, though: they still have the password or the session and can add a new rule tomorrow. The monitoring analyst (04) confirms the attack, locks the account and closes the open sessions.
An employee gets a link asking for permission for an app with a believable name, and clicks “Accept”. The app gains access to their email and files, with no password and no code, and keeps it even after the password changes. It touches no computer. Identity detection (03) sees the new app with broad rights, and the monitoring analyst (04) confirms and revokes its access.
Somebody opens the attachment of a fake invoice. If the file is already known, antivirus (01) blocks it on opening. If it is new, endpoint detection (02) sees what the program does, and the monitoring analyst (04) confirms and checks whether it reached other machines.
The attacker brings no new program: they use PowerShell and the tools already installed in Windows. Antivirus has nothing to scan. Endpoint detection (02) watches behavior rather than files: it recognizes the pattern and blocks it on its own, straight away. That leaves the question of where it started. The monitoring analyst (04) checks how the attacker got in and whether they still have another way in.
Everything shows on the endpoint here: processes starting to encrypt files. Endpoint detection (02) raises it within seconds, a monitoring analyst (04) confirms it is an attack, and only then is the machine isolated. Identity detection (03) checks whether the attacker also managed to take accounts from that computer.
The attacker has got into one machine and tries to move to others on the network, using Windows tools and the accounts found there. It all happens on computers, so endpoint detection (02) sees every hop from one machine to the next, and the monitoring analyst (04) confirms the attack before the machines involved are isolated.
The attacker signs in to the company VPN with a guessed or stolen password and starts looking for vulnerable devices on the network. They use no company computer and none of the Microsoft 365 accounts, so endpoint detection (02) and identity detection (03) have nothing to see. The traces sit in the VPN and firewall records. Every log in one place (SIEM) brings them together and reveals the pattern: a new connection touching dozens of addresses within minutes. The monitoring analyst (04) confirms and shuts the access.
A supplier’s email account is compromised, and the attacker writes to you from their real address: an ordinary invoice, with a new bank account. The message comes from a legitimate account outside your company, so no technical layer has anything to raise. Only the person reading it can stop it, by calling the supplier before paying. That is what team training (SAT) is for.
The same layers are worth asking of any provider, ours included. Add one more question to them: what happens, step by step, in the first hours after an alert? A provider with a real process describes it on the spot. One without will explain why it depends.
Three things you can compare, point by point, against any other cybersecurity offer you receive: who actually responds during an incident, what is in the subscription at no extra cost, and what you can verify yourself in a public database.
Many companies have all five layers. What's missing almost everywhere is a single point of contact.
You do not call the detection supplier, then the network one, then the backup one. You call one number, and we talk to the rest.
When three suppliers share a problem, each one points at the others. With us, there is nobody to argue with: we answer for the whole chain.
Alerts are confirmed by analysts at any hour, twenty-four hours a day. The Bucharest team that built your network does the repair; they've worked together for years and know what cannot be switched off at your company.
We do not sell an IT support subscription without security. There is no basic package without protection and a paid security add-on. Everything below is part of the day-to-day work, at the same price.
Three things we can stand behind. The first you can verify yourself, in a public database.
Our own information security management system, certified and externally audited every year. Certificate no. RO231109006. Verify it in IAF CertSearch
From receiving the alert to the attack being stopped. Cleanup comes afterward.
SOC monitoring, including nights, weekends and public holidays.
These are not our numbers. They come from the annual report of the National Cyber Security Directorate for 2025, published in August 2026.
From 248 cases in 2024 to 1,125 in 2025. The Directorate puts the rise down to reused passwords and missing two-step sign-in.
Up 70.6%, to 4,975 incidents, which is 36% of everything reported. It has become the main way attackers get in.
256 major incidents. Among the victims, 119 companies and 22 public institutions.
3,937 cases. One company in the defense industry lost more than 20,000 euros in a single incident.
One detail from the report is worth reading twice: phishing messages are now written in correct Romanian and convincingly imitate the visual identity of real organizations. The advice everyone repeats, that you spot them by the spelling mistakes, no longer works.
Source: the 2025 activity report of the National Cyber Security Directorate, public version, approved by CSAT Decision no. 117 of 7 August 2026.
The same attack, minute by minute, through all five layers. The example is constructed, the pattern is not.
A remote access program starts on the computer in accounting and opens a connection to an address outside the country.
The same thing happens. Nobody has any way of knowing.
A security analyst looks at the alert and confirms it is a real attack, not a new program somebody in the company installed.
The attacker starts moving laterally, from one machine to the next. It is the pattern the Directorate describes in the attack on Bucharest City Hall.
Only now is the computer isolated, once the analyst confirms it is an attack. It stays on and the accountant still has her local files, but the machine can no longer reach the internet, email, the folders on the server or the other computers. The only connection left open is the one used to investigate and clean up remotely.
They reach the file server. They copy what they find.
You call us, or we call you. You already know what happened; in words you understand.
The first employee arrives at the office. Everything looks normal.
We pick up the PC, do a fresh Windows reinstall, reconfigure it, and deliver it back the same day. And your accountant stays on track.
The bookkeeper is working too. Nobody knows anything yet.
You hear from us what happened, how they got in and what we changed.
Nothing. The same day as any other.
Nothing. The incident was closed three weeks ago.
A client calls to ask why they have unpaid invoices, even though they already paid them.
Which of the two columns is your company in right now?
Find out in 45 minutes, freeCompared with where we were before, the current state of our IT infrastructure, in organization, structure, security and monitoring, is far better. A significant upgrade that lets us look to the future with confidence and certainty, both internally and in our relationship with our clients.
Translated from Romanian.
We will not promise you will never be attacked. You will be, sooner or later. Anyone who promises otherwise either does not understand how this works, or hopes you will not ask further.
We will not promise we catch absolutely everything either. The weakest link is still the person. Somebody clicks a link on a busy day, and no technical layer cancels that risk entirely. That is why training your team is an option worth discussing, not a nice-to-have.
What we do promise is that every layer reduces what gets through, that whatever does get through is seen in minutes rather than weeks, and that you find out exactly what happened. We do not work with certainties, we work with odds, and five layers shift the odds a long way in your favor.
The difference between an attacked company that is back at work the same day and one that loses a week is not luck. It is what was in place beforehand.
Yes, and it is worth knowing why. The baseline layers work on any license: antivirus comes with Windows, the detection agent is installed on every machine, and analysts watch around the clock. But with Microsoft 365 Business Premium, protection genuinely improves, not just on paper.
Business Premium includes Intune, through which we define security policies once and apply them to every computer in the company. Some we switch on directly, following best practice, such as two-step sign-in. Others we agree with you, for example who is allowed to create SharePoint sites, so that protection does not get in the way of how your team works.
It also adds an extra source of telemetry on top of our agent, so the same attack is seen from more angles. And if your company needs compliance or a certification, Business Premium becomes practically essential: without it you do not have the tools an audit asks for.
Antivirus compares files against a list of known threats and blocks what it recognizes. EDR watches behavior on your computers rather than files: it blocks clear patterns on its own, such as an attack that uses no file at all, and flags the rest to the analysts. MDR is the same EDR, plus an analyst who confirms it really is an attack and stops it spreading.
The difference between them is not the software but the people watching it. A detection tool is paid monthly, per machine, and stays inexpensive. The analyst who watches what it reports is the part that costs, and that analyst is also the difference between an attack stopped in 8 minutes on average and an alert read on Monday morning. For the clients we manage, MDR is the standard, whatever the size of the company.
Because traditional antivirus only looks at files, while damaging attacks generally don't use files anymore. An attacker who signs in with a stolen password and uses the programs already installed on the machine, a technique known as living off the land, triggers nothing, because there is no file to scan. This is where behavior detection (EDR) and identity detection (ITDR) do the work, together with two-step sign-in.
The National Cyber Security Directorate reported a 353% rise in compromised accounts in a single year. In a compromised account, antivirus has nothing to stop: there is no file to scan.
An accounting firm handles its clients' financial data, so it has two things to protect: the data, which falls under the GDPR, and email, through which invoices and payments travel. What the market calls MDR covers three of our layers: endpoint detection (EDR), identity detection (ITDR) and the analysts who watch alerts around the clock (SOC monitoring). All three are included in managed IT.
For fake invoices sent from a supplier's real, compromised address, team training also matters: it's the only layer that can stop such an invoice. Training is optional. If you're not sure what applies to your firm, the free 45-minute assessment starts exactly there.
It does not appear as a separate line on the invoice, because we do not sell it separately. It sits inside the IT support subscription, and the cost depends on how many users you have, how many locations, how many servers, and whether you already have an internal team.
You get the exact figure at the free 45-minute assessment, along with what you already have and no longer need to pay for.
That you cannot buy managed IT from us without it. There is no basic package without protection and a paid security add-on. All five layers are included for every client, from small firms to companies with hundreds of users.
The reason is simple: when a company we run gets attacked, it becomes our problem too.
Yes, and this is actually the most common scenario. Your internal IT manager cannot, and shouldn't have to, provide 24/7 coverage in the middle of the night. We take over continuous monitoring and incident response, allowing them to focus on strategic business projects.
This model is called co-managed IT and is designed specifically for this situation.
Look at three things you can check yourself. First, certification: Risksoft is ISO/IEC 27001:2022 certified, certificate RO231109006, verifiable in IAF CertSearch and externally audited every year. Then, who watches the alerts and when: with us, security alerts are watched around the clock by specialist analysts we work with, and a computer is isolated only after an analyst confirms it really is an attack. On average, 8 minutes pass from the alert to the attack being stopped.
Third, what the subscription includes: the five security layers are part of managed IT, not sold separately. No serious company can promise you won't be attacked. It can tell you clearly what it does when it happens.
The attack is flagged within minutes, an analyst confirms it really is an attack and stops it spreading, then checks whether it reached anywhere else. We do not stop the company for a false alarm. We clean the machine, reconnect it and get your people back to work.
Then you hear from us how they got in, what they touched and what we changed. We do not promise you will never be attacked. The aim is that you do not hear about it from a client, three weeks later.
It depends on your sector and on the size of the group your company belongs to. The NIS2 Directive is transposed into Romanian law through Government Emergency Ordinance 155/2024, approved by Law 124/2025. If NIS2 applies, security measures stop being a choice, and accountability sits with management, not with the IT department.
Check in five questions whether it concerns you, in our guide to NIS2 in Romania.
Cybersecurity does not stand on its own. It is part of how we run the whole of a company’s IT, from small firms to mid-sized companies with hundreds of users.
The two things clients ask us about most often, written up in full.
We look together at what you have now and tell you what is missing. You pick the time · 45 minutes, online · Written quote afterwards · No obligation
