04 Managed Security Service Provider
Managed SOC monitoring and detection with CSIRT incident coordination under agreed SLAs — without building a full in-house operations stack first.
Measurable assurance for regulated institutions.
Banks, insurers, fintech, healthcare, energy and critical enterprises.
How we engage
We work with teams that design and oversee critical systems — where outcomes must stand up to audit and supervisory review. From Chișinău, with EU-facing engagements.
Scoped to agreed criteria
Scope, evidence and reporting aligned to supervisory and audit expectations from the start.
One accountable engagement
Assurance, security operations and platform delivery under a single scope, SLA and reporting line.
Independence when required
Assurance opinions segregated from implementation — separate scope and teams where independence matters.
Operated lines
Three production lines — MSSP, TSP and ISP — under published SLAs and operational governance. Platforms and connectivity we run continuously, separate from client consulting.
00 Trust Service Provider
Advanced electronic signature programme under our own PKI and published CP/CPS — and governed validation of European and Moldovan PAdES, XAdES, CAdES and ASiC on EU DSS.
09 Internet Service Provider
Managed IP connectivity with Anti-DDoS, CDN and NGFW under documented SLAs, change and incident processes.
Selected engagements
Four practice areas for banks, fintech and critical infrastructure — assurance, testing, architecture and awareness. Scoped to agreed criteria.
01 Management System Assurance
Independent audit of QMS, ITSM, BCMS and ISMS against agreed criteria. Implementation and remediation support is available as a separate advisory engagement, with independence safeguards.
03 Penetration Testing & Red Teaming
Authorised testing of applications and networks under rules of engagement, with evidence and prioritised remediation recommendations.
06 Security Architecture & Hardening
Security architecture, segmentation, hardening and monitoring baselines for cloud and on-premises platforms. Independent assurance of the resulting controls is scoped separately when required.
10 Security Awareness & Training
Role-based security awareness and competence training for management and technical teams in regulated environments.
Selected cases
Anonymised engagement patterns from regulated and critical infrastructure — full catalogue on the cases page.
01 End-to-end PKI transformation
The National Public Key Infrastructure (PKI), providing trust services (digital signatures, authentication and timestamping) for government and regulated industries, required comprehensive modernisation. The system…
02 National-scale SOC programme
A national-scale security operations mandate required a production SOC protecting critical infrastructure across multiple sectors — with no high-availability monitoring platform, no structured detection and response…
03 Critical national event — cyber defence
During the 2024 national electoral process, critical digital infrastructure faced sustained high-pressure threat activity — large-scale DDoS, social-engineering campaigns and real-time attacks against availability and…
04 National incident response platform
National incident reporting and investigation lacked a single structured platform — cases tracked inconsistently, forensic artefacts collected ad hoc and hand-offs between monitoring, hunting and response teams without…