Security, without the alphabet soup.

Software that reasons over data to draft findings a specialist then reviews.

At Sciber, AI is used inside a controlled method: agents triage, correlate and document, and a named specialist owns every decision that reaches you.

A defined way for two systems to exchange data automatically.

Integrations between your security tooling and ours are built on APIs, so telemetry, cases and context move without manual export.

A well-resourced attacker that stays hidden in an environment over time.

APT activity is quiet by design. It is found by hunting for behaviour rather than by waiting for an alert.

Continuously finding everything of yours that is reachable from the internet.

Attack surface management discovers exposed assets, services and shadow IT, then prioritises what an attacker would reach first.

Fraud where an attacker abuses a trusted mailbox to redirect money or data.

BEC rarely involves malware. It relies on a hijacked or spoofed identity and a convincing message, which is why identity signals and email security matter together.

A control point between users and cloud services that enforces policy.

A CASB gives visibility into sanctioned and unsanctioned cloud use and applies data and access rules to it. It is normally delivered as part of a wider SSE platform.

The organisation behind widely used hardening benchmarks and controls.

CIS benchmarks give concrete, testable configuration baselines, which makes them a practical yardstick in improvement work.

The person accountable for security strategy and risk in an organisation.

The register of your assets and how they relate to each other.

A CMDB is only useful when it matches reality. Asset security work compares it against what is actually observed in the environment.

The team that takes over when an incident needs hands-on containment.

Our CSIRT handles confirmed intrusions end to end: containment, eradication, recovery and a written account of what happened.

Ongoing offensive testing built into how your applications are developed.

Working through exposure continuously instead of in yearly cycles.

CTEM ties discovery, validation and remediation into one loop, so the list you act on reflects this week rather than last year's report.

The public identifier given to a specific known vulnerability.

A CVE number lets everyone refer to the same flaw. Our advisories use them so you can match findings against your own inventory.

A 0–10 score for how severe a vulnerability is.

CVSS describes technical severity, not your risk. We pair the score with exposure and exploitation data before deciding urgency.

A signature that proves an email really came from your domain.

Controls that stop sensitive data leaving where it should not.

The policy that tells receivers what to do with mail failing your checks.

DMARC builds on SPF and DKIM. Without it, anyone can send mail that looks like it comes from your domain.

The internet's address book, translating names into addresses.

DNS is both an attack path and a rich detection source: malicious infrastructure has to be looked up before it can be reached.

EU regulation on operational and cyber resilience for financial entities.

DORA sets requirements for incident reporting, testing and third-party risk across the EU financial sector.

Monitoring the open, deep and dark web for threats to your brand, people and data.

Attack surface management seen strictly from the outside, as an attacker sees it.

Software on laptops and servers that detects attacks and can isolate the machine.

EDR is the sensor closest to the attacker. It supplies the process and identity detail our investigations depend on.

EU law governing how personal data is handled and protected.

Controlling who can sign in and what they are allowed to reach.

The control systems that operate industrial processes and machinery.

ICS environments prioritise availability and safety, so security has to be introduced without interrupting production.

The international standard series for securing industrial automation.

IEC 62443 structures OT security into zones and conduits with defined security levels, which gives segmentation work a recognised frame.

A concrete trace — a hash, domain or address — that points to an intrusion.

Network control that detects and blocks known attack patterns in traffic.

The work of containing, eradicating and recovering from a security incident.

Incident response is judged on preparation. We run readiness assessments and exercises so the real event follows a rehearsed path.

The international standard for running an information security management system.

ISO 27001 is about governance: documented risk decisions, controls and evidence that they are followed.

The office and business systems side of your environment, as opposed to OT.

The ticketing and workflow system your IT team uses to handle requests and incidents.

The query language used to hunt and detect in Microsoft security data.

Our hunts and detections ship as readable KQL, documented in your playbooks so your own team can run and adapt them.

The type of AI model that reads and writes natural language.

LLMs are useful for summarising and documenting security work. Which model runs where, and on whose data, is a governance decision.

Microsoft's cloud suite for identity, mail, files and collaboration.

M365 holds identity, mail and documents in one place, which makes both its configuration and its security signals central to detection.

A 24/7 service that detects, investigates and responds to threats in your environment.

Sciber MDR combines AI SOC agents with named specialists. Every case is investigated with a documented method, and the result is written down in language your board can read. MDR+ adds proactive threat hunting and continuous improvement on top.

Requiring more than a password to prove who is signing in.

A public catalogue of how attackers actually behave, step by step.

We map detections, hunts and test results to ATT&CK so coverage gaps are visible rather than assumed.

A supplier that operates security tooling on your behalf.

The classic MSSP forwards alerts. An MDR provider owns the investigation and the response, which is the difference we build on.

How long it takes on average before an attack is noticed.

How long it takes on average from detection to containment.

Detecting attacks from network traffic rather than from the endpoint.

Endpoint prevention that uses machine learning to stop known and unknown malware.

EU directive raising security and reporting duties for essential sectors.

NIS2 widens both the sectors in scope and management accountability, with short deadlines for incident notification.

The US body behind widely used security frameworks.

The NIST Cybersecurity Framework is a common language for describing maturity: identify, protect, detect, respond, recover.

The systems that run physical production — machines, lines and plants.

OT cannot simply be patched or rebooted. Security there starts with visibility and segmentation, and with detection that does not disturb production.

The community behind the best known list of application security risks.

OWASP methodology underpins how application testing is scoped and reported.

Controlling and recording the accounts that can change everything.

The security requirements that apply when you handle card data.

Data that can identify a person, such as a name, email address or ID number.

Ransomware sold as a product, with affiliates running the intrusions.

RaaS is why ransomware is so common: the tooling, negotiation and infrastructure are supplied, so the attacker only needs access.

Applications delivered over the internet rather than installed by you.

Networking and security delivered together from the cloud.

SASE combines network connectivity with SSE security controls. We focus on the security half and keep it vendor-realistic.

A list of the components a piece of software is built from.

When a component turns out to be vulnerable, an SBOM answers the only question that matters: where do we have it?

The systems that monitor and control industrial processes centrally.

The stages software goes through, from design and coding to release and maintenance.

The platform where security logs are collected, searched and alerted on.

A SIEM is only as good as what you send it. Telemetry pipelines decide which data belongs there and which belongs in cheaper storage.

The response and delivery times we commit to in writing.

Automating repeatable response steps across your security tools.

The team and tooling that watch your environment around the clock.

Our SOC pairs AI agents with Nordic specialists on a continuous shift, so detection, investigation and response happen in one place.

An audited report on how a service provider handles security and data.

A record listing which servers may send mail for your domain.

Cloud-delivered security that protects users wherever they work.

SSE brings secure web access, private application access and cloud data control into one service instead of a stack of appliances.

Signing in once to reach many applications.

SSO concentrates access in one identity. That is good for control and makes that identity a prime target.

A filter between users and the web that blocks malicious destinations.

The encryption that protects data while it travels between systems.

The repeatable behaviour that identifies a particular attacker.

Detection based on what is unusual for a given user or system.

An encrypted tunnel into a network — historically the default remote access.

A VPN grants broad network access once the tunnel is up, which is exactly what zero trust replaces with per-application access.

A filter in front of web applications that blocks malicious requests.

A WAF can act as a compensating control, shielding a critical vulnerability until it can be patched.

Detection that correlates endpoint, identity, email and cloud signals together.

XDR gives one case instead of four separate alerts. Our agents work directly inside Microsoft Defender XDR.

Giving access to one application at a time, never the whole network.