What size of organisation is typically a good fit?

We typically work with organisations between 50 and 2,000 users - the mid-market segment that is too complex for basic off-the-shelf tools but too lean to run a mature in-house security function. Our clients often have a small IT team, limited dedicated security headcount, and growing compliance obligations.

What does the onboarding process look like?

Onboarding begins with a Security Maturity Assessment that maps your current posture across People, Process, and Technology against frameworks like NCSC CAF, NIST, and CIS Controls. This gives us a shared baseline before any tooling or services are introduced.

What services does Koncise cover?

Our services span six areas: Detect and Respond (24/7 MDR, SIEM/SOAR, Incident Response), Stop Phishing and Human Risk (managed phishing simulation, DMARC, email security), Secure Data and Prevent Loss (DSPM, CASB, DLP), Protect Identity and Access (ITDR, MFA, ZTNA), Patch and Harden (Vulnerability Management, UEM/RMM), and Assurance and Compliance (Security Maturity Assessment, Cyber Essentials, Security Roadmaps). Alongside these, our Security Validation practice tests whether that coverage actually works - penetration testing, adversary simulation and detection validation.

How do you extend a small internal security team's capacity without replacing it?

We integrate into your existing function as an extension, not a replacement. Our 24/7 MDR capability handles continuous monitoring and response, freeing your internal team to focus on projects, architecture, and stakeholder communication.

What's the difference between what Koncise does and hiring in-house?

A mid-market organisation hiring equivalent in-house capability - a SOC analyst, security architect, compliance specialist, and phishing awareness manager - would face significant recruitment cost, retention risk, and coverage gaps. Koncise provides that breadth of capability under a single managed service relationship.

What is 24/7 MDR and when does a business actually need it?

Managed Detection and Response (MDR) is a continuous monitoring and response service that watches your environment around the clock, detects threats in real time, and contains them before they escalate. A business needs MDR when it cannot staff a security operations centre internally.

How is MDR different from antivirus or a basic EDR solution?

Antivirus and basic EDR tools detect and block known threats at the endpoint but do not provide investigation, triage, or active response. MDR adds a human layer - analysts who review alerts, investigate suspicious behaviour across your environment, and take containment action.

What is phishing simulation and does it genuinely change employee behaviour?

Phishing simulation involves sending realistic but safe phishing emails to employees to test their responses, followed by targeted training for those who interact with them. Evidence consistently shows that repeated simulation - combined with contextual training - reduces click rates and improves reporting behaviour over time.

What does Cyber Essentials certification involve and is it worth it?

Cyber Essentials is a UK government-backed certification scheme that verifies five foundational security controls: firewalls, secure configuration, access control, malware protection, and patch management. It is worth pursuing as a baseline standard, as it is increasingly required by public sector clients and insurers.

What is a Security Maturity Assessment and what does it produce?

A Security Maturity Assessment is a structured review of your security posture across People, Process, and Technology, mapped against recognised frameworks including NCSC CAF, NIST, and CIS Controls. It produces a scored baseline, a gap analysis, and a prioritised roadmap.

Can we start with one service area and expand later?

Yes. Most clients begin with one or two service areas that address their most pressing risks and expand coverage over time as budget and capacity allow. The Security Maturity Assessment helps identify the right starting point.

What is DMARC and do we need it alongside an email security gateway?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a protocol that prevents your domain from being used in email spoofing attacks. An email security gateway filters inbound threats; DMARC protects your outbound domain reputation and stops attackers from impersonating your organisation to your customers and partners.

What kinds of events does Koncise run?

Koncise runs three formats: the Suffolk Security Social (a flagship gathering for IT leaders across East Anglia), the Curry Club (a relaxed networking dinner, now in its seventh edition), and Board-Level Security Conversations (intimate sessions for C-suite leaders).

What is DKIM and why does it matter for email security?

DKIM (DomainKeys Identified Mail) adds a cryptographic digital signature to outgoing emails, verified by recipients against a public key in your DNS. It proves the email genuinely originated from your organisation and hasn't been tampered with in transit. DKIM needs to work alongside DMARC, which enforces action when DKIM signatures are missing or invalid.

Cybersecurity Partner · Specialists You Can Trust

Human Centric Businesses Deserve Human Centric Security

Sophisticated threats. Constrained resources. We help you understand where you stand, build what’s genuinely missing, test whether it holds - and prove it’s getting better.

Start a Conversation Is This You?

170+

Clients that secure with Koncise

100k

Users protected globally

99%

Client retention rate

14yr

Building long-term trust

"Their market knowledge and approachability are second to none. They form an important part of my trusted sounding board for all things cybersecurity procurement."

★★★★★

Andrew Powell

CIO, Top 50 UK Law Firm

Scroll

Trusted by organisations across the UK

The Reality

Your job is genuinely hard right now.

You're stretched too thin. The threats evolve daily. Your budget hasn't. Somehow you're expected to protect everything, educate everyone, and justify every pound spent.

Most organisations are being held to enterprise expectations without the team, budget, or breathing space to match. And the security industry doesn't help - it thrives on complexity, acronyms, and fear. We don't.

Too big to ignore risk

You're past the point where a basic antivirus and good intentions are enough. The threat surface is real and growing.

Too small for enterprise overhead

Enterprise solutions assume a dedicated security team, massive budgets, and months to implement. You have none of those.

Drowning in vendor noise

Every tool is sold as essential. Every vendor promises transformation. You need someone to cut through it - not add to it.

Justifying spend upward

The board speaks business risk, not CVEs. You need outcomes that translate - not technical reports nobody reads.

Spending without proof

You've invested in tools, controls and services. But nobody has ever actually tested whether they'd hold - and that's a difficult question to answer when the board asks.

How We Improve Security

The Koncise Security Improvement Model

Understand it. Build it. Test it. Improve it. Prove it. Five stages that turn security from a set of purchases into something you can actually evidence - anchored by the Security Maturity Assessment, and measured against it every time round.

01

Assess

Know where you stand before you spend.

Maturity · Risk · Roadmap

Explore the portfolio →

02

Build

Build what’s actually missing.

The Security Portfolio

See the Six Pillars →

03

Test

Coverage built. Now let’s try to break it.

Technology · People · Process

How we test →

04

Fix

Fix what testing proves matters.

Prioritised Improvement

What happens next →

05

Prove

Prove the improvement is real.

Retest · Measure · Evidence

Proving improvement →

Next time, the list is shorter.

We come back to the start - but not to the same place. Each cycle begins from a stronger position than the last.

Est. 2012 · Borehamwood & Ipswich

Who We Are

We're not a vendor.
We're your team.

Koncise is an award-winning cybersecurity partner with a single operating principle: do right by customers, even when it conflicts with short-term revenue. Fourteen years of practising that has led to a 99% client retention rate and relationships that last decades.

Consultative by default - we help you make decisions, not buy products
No autoresponders, no generic pitches, no churn-and-burn sales culture
Deep expertise across 24/7 MDR Services, AI Cloud Email Security & Managed Phishing Simulation
Offices in Hertfordshire and Suffolk - with clients across London, East Anglia and the UK

Social Proof

Don't take our word for it.

"Koncise would always offer advice from a technical and comparative point of view. I would happily advise anyone to engage with them."

★★★★★

Jamie King

IT Manager

"I have been working with Koncise for the past 2 years understanding human risk through their phishing simulation service and I can say the service has been thoroughly professional and second to none, culminating in a tangible reduction in insider threat risk. I also congratulate Koncise for their passion and work elevating the importance of cyber security in our local and national business communities."

★★★★★

Kevin W.

Head of Cyber and I.T. Security

"As a fast-growing business, we needed a security solution that could scale with us and provide 24/7, year-round protection for our global network of people and data. Koncise worked closely with us from pre-sales to post-sales support, ensuring we were fully set up. It's great to have one less thing to worry about knowing that we have a team of cybersecurity experts hunting and responding to cyber threats on our behalf."

★★★★★

Andrew F.

Head of I.T.

"Ben and his team are extremely customer-focused and pride themselves on forming strong relationships. They advise in an impartial way - genuinely second to none."

★★★★★

David Hymers

IT Director, Wedlake Bell LLP

"It has been an absolute pleasure working with Koncise over the past couple of years. Their flexible and supportive customer-first approach aligns perfectly with the needs of our Education Trust, making them an invaluable partner. Thanks to their efforts, we have made significant strides in our ongoing security journey!"

★★★★★

Scott H.

Trust Lead for Cyber Security

"We approached Koncise to enhance our cybersecurity and were immediately impressed by their knowledge, product awareness, and approachable team. They successfully ran a phishing email campaign to boost awareness and helped enhance our threat protection solution. We look forward to continuing our partnership and highly recommend them to other local businesses."

★★★★★

John F.

Group I.T. Manager

"They have a real desire to work with you, adding value to your business, finding the right solutions to solve your problems. A genuine personal touch and first-class service."

★★★★★

Matt Ascott

IT & Operations Director, IGF

"Koncise has helped enable us to put the ownership of emails back on to the user. Because ultimately, we're just one team - regardless of size, you can't see everything, and you have to trust your people not to click. The email protection banners and link rewriting are invaluable. There's just that extra layer of protection."

★★★★★

Jenny C.

I.T. Systems and Development Manager

"Koncise acts as our trusted cybersecurity adviser. They conducted an in-depth phishing simulation exercise, providing us with a comprehensive report and strategic advice to enhance our defences. By working with Koncise to deploy a full intelligent email security platform, we simultaneously enhanced both our inbound and outbound defences. It's fantastic to work with a single provider that can do both - the process was incredibly easy and collaborative."

★★★★★

Jonathan B.

Associate Director of I.T.

"All of our engagements with Koncise are productive and conducted in a no-sales-pressure environment, allowing for open conversations and meaningful solutions."

★★★★★

Trusted Client

IT Director, Legal Sector

"We're delighted that our data security efforts have been recognised - we're Cyber Essentials Plus Certified! This wouldn't have been possible without the help of Koncise, trusted local cybersecurity experts here in Ipswich."

★★★★★

Henry G.

I.T. Manager

"The team at Koncise have raised the awareness of cybersecurity within our organisation which has led us to be able to empower and educate our staff around the importance of cyber risk."

★★★★★

Leon P.

I.T. Systems and Infrastructure Manager

"Super responsive. The team negotiates on our behalf to not only get a fair deal but provides expert advice on roadmaps. I really appreciate your support."

★★★★★

Jonathan Woolley

IT Director, Atomico

"After implementing our email security solution with Koncise, we initiated a second phishing test - and nobody clicked on anything - our click rates were literally zero. It works."

★★★★★

George HC.

I.T. Manager

"Our partnership with Koncise has empowered our end users with the knowledge to determine whether an email is likely a phishing scam and given us the confidence to communicate through email securely and efficiently."

★★★★★

Mason B.

Director of IT, AI, and Systems

"I've worked with Koncise for over a decade across various organisations. Stephen and Ben are focused on Customer Success and go out of their way to ensure services are well-embedded."

★★★★★

Trusted Client

IT Director, Legal Sector

"The Koncise team were very efficient in helping us enhance our Endpoint Security."

★★★★★

James M.

Head of I.T.

Step 02 - Build

The Six Pillars of the Koncise Security Portfolio

Six specialisms, working together as one cohesive strategy. Most clients start with one or two and expand as budget and maturity allow.

01 Detect & Respond to Threats 24/7 Faster detection and containment. 02 Stop Phishing & Human Risk Measurable behaviour change. 03 Secure Data & Prevent Loss Reduced data exposure. 04 Protect Identity & Access Fewer account takeovers. 05 Patch, Harden & Reduce Attack Surface Fewer exploitable gaps. 06 Assurance & Compliance Board-ready evidence.

Explore the Portfolio

Step 03 - Validation

Coverage built. Now let’s try to break it.

Everything above is a control you’ve chosen to trust. Security Validation is where we find out whether that trust is justified - testing the technology, the people and the processes that sit around it. Some of that is penetration testing. Some of it is phishing simulations and tabletop exercises. All of it produces evidence rather than assumptions.

Penetration Testing

Real-world testing of networks, infrastructure, web applications and APIs - establishing what can genuinely be reached and exploited.

Explore penetration testing →

Adversary Simulation

Goal-led exercises across people, technology and physical or process controls. Not “what’s wrong here”, but “could someone actually achieve this”.

Explore adversary simulation →

Detection Validation

Establishing whether your monitoring and response genuinely detect, escalate and act on realistic attacker behaviour.

Explore detection validation →

See how we test

Ready to understand your real security position?

Start with a Security Maturity Assessment. No sales pitch - just clarity.

Start a Conversation Scope a Penetration Test

No pitch. No pressure. Just a conversation.

Common Questions

Questions & Answers

What is Koncise and what kind of businesses do you work with?

Koncise Solutions is a UK-based cybersecurity partner built for mid-market organisations - businesses that face real and growing security obligations without the internal headcount, budget, or structure to manage them at an enterprise level. Founded in 2012, we work with IT Directors, Information Security Managers, Infrastructure Managers, and senior business leaders across professional services, legal, financial services, education, healthcare, and the third sector. If you have a small IT team carrying a large security obligation, 170-plus clients have been in exactly that position.

How is Koncise different from other MSSPs or cybersecurity vendors?

Koncise operates as a long-term partner rather than a product-led vendor. We do not run quota-driven sales cycles, we do not disappear after contract signature, and we retain over 99% of our clients year on year - which reflects how we work, not just what we sell. We will tell you when something is not right for your environment, and we will recommend a course of action that serves your interests even when it does not maximise our revenue in the short term.

What are the signs that a business has outgrown its current security setup?

The clearest signals are: a cyber insurance renewal that asked questions you could not answer with confidence; a phishing email that reached your users or caused a genuine incident; a growing reliance on cloud and SaaS platforms with limited visibility of who has access to what; an auditor, client, or supply chain partner asking for security evidence you do not have; or a sense that your current approach is reactive rather than planned. If any of these apply, an independent baseline assessment is a useful first step - not a commitment to buy anything.

What do the first 90 days working with Koncise typically look like?

We start with a Security Maturity Assessment - a structured review across People, Process, and Technology that takes three to four weeks and gives both parties an evidence-based picture of where you are and what needs to happen next. From there, we produce a prioritised roadmap and agree which areas to address first based on your risk profile, budget, and existing tooling. By the end of 90 days, most clients have completed the assessment, confirmed their top priorities, and have at least one service area live with a clear plan for the rest of the year.

Do we need a dedicated internal security team to work with you?

No. Most of our clients do not have a dedicated security function. Koncise is designed to extend the capacity of a small IT team - providing 24/7 detection and response, human risk management, and compliance support without requiring a fully staffed internal SOC. We work alongside your existing team and provide depth in the areas where you need it most.

We already use Microsoft 365 security tooling - does that mean we're covered?

Microsoft 365 provides useful baseline controls, but they do not add up to a complete security posture. Defender covers endpoint and email signal; Entra ID manages identity. Most mid-market configurations still have significant gaps - particularly around continuous threat monitoring, active response outside business hours, phishing behaviour change, data governance, and compliance evidence. Our Security Maturity Assessment regularly identifies issues in M365 environments that are technically deployed but misconfigured or only partially enforced. We work alongside your Microsoft stack rather than replace it.

How does Koncise decide whether a client needs managed services, advisory support, or both?

We work that out during the Security Maturity Assessment. Some organisations need managed services - active 24/7 MDR, phishing simulation, identity protection - because their monitoring and response capability is limited or absent. Others have reasonable tooling in place and benefit more from advisory: structured assessments, compliance roadmaps, and board-ready reporting. Many clients need both, in a specific sequence. We will not recommend managed services where advisory is the right first step, and we will not lead with advisory where active threat risk requires immediate managed coverage.

How does Koncise help justify security spending to a board?

We produce structured, business-readable outputs - Security Maturity Assessments, risk-mapped roadmaps, and compliance reports - that translate technical risk into language boards respond to: financial exposure, regulatory liability, and operational continuity. We help IT leaders frame security as a business decision rather than a technical cost, with something documented and defensible to present - not a slide deck built on fear.

What does Koncise's service portfolio cover?

Six connected areas: Detect & Respond (24/7 MDR, SIEM/SOAR, Incident Response), Stop Phishing & Human Risk (managed phishing simulation, DMARC, security email gateway), Secure Data & Prevent Loss (DSPM, CASB, DLP), Protect Identity & Access (ITDR, MFA, ZTNA), Patch, Harden & Reduce Attack Surface (Vulnerability Management, UEM/RMM), and Assurance & Compliance (Security Maturity Assessment, Cyber Essentials, Security Roadmaps). Alongside the six pillars, our Security Validation practice tests whether that coverage actually holds - penetration testing, adversary simulation and detection validation. Most clients start with one or two areas and expand as budget and maturity allow.

Where is Koncise based and which businesses do you serve?

We have offices in Borehamwood, Hertfordshire and Ipswich, Suffolk, and serve UK mid-market businesses across sectors - with particular depth across East Anglia, the Home Counties, and London, and clients across the wider UK.

Do you carry out penetration testing yourselves, or subcontract it?

Testing is delivered by our own security testing team. The people who scope the engagement with you are the people who carry out the work and walk you through the findings afterwards. That matters practically as well as commercially - it means findings can be discussed properly rather than relayed through a third party, and it means the people who found the problem can help you understand what to do about it.

Doesn't security testing just create a sales opportunity for you?

It would be a fair question to ask of anyone who both tests and remediates. Our position is straightforward: the finding is the finding. We report what we found, what it means, and what needs to change - independently of whether you ever buy anything else from us. Where something is fixed by a configuration change that costs nothing, we say so. Where we can help, we mention it once and leave the decision with you. You should be able to hand our report to any provider and have it be just as useful.

About You

We Work With IT Leaders Facing Impossible Choices

This page isn't a sales pitch. It's a reality check. If you read this and think "finally, someone who gets it" - that's because we do.

"You're stretched too thin. The threats evolve daily. Your budget hasn't. And somehow, you're supposed to protect everything, educate everyone, and justify every pound spent - all while not becoming the person everyone avoids in the hallway."

Who We Work With

Sound familiar?

These aren't personas we made up. They're the people we talk to every week.

IT Directors

Struggling to make security make sense to your board?

You need to justify cybersecurity spending in business language, not technical jargon. Every board meeting feels like defending security rather than advancing strategy. You're expected to translate technical risk into financial exposure - without a translation guide.

Information Security Managers

Drowning in threats with limited resources?

You're expected to do more with less while the threat landscape grows daily. The pressure to be everywhere at once is unsustainable. You need a partner who extends your capacity - not another tool to babysit.

Infrastructure Managers

Security measures slowing down your systems?

You're caught between the security team's requirements and your users' expectations. Every control adds friction. Every approval process adds delay. You need security that enables - not obstructs.

Finance Leaders

Unable to see clear ROI on security spending?

Security investments are sold on fear, not financial returns. You can't quantify cyber risk the same way you assess other business risk - and vendors aren't helping. You need numbers, not nightmares.

Stephen Dorling

Founding Account Manager

"Every leader I speak to is carrying the same weight - too much responsibility, too few resources, and a board that expects certainty in an uncertain world. We built Koncise around that reality. My job is to make sure you're never left trying to figure it out alone. From day one, we embed ourselves alongside your team, translate the technical into the commercial, and make sure that every engagement drives a measurable outcome you can actually stand behind."

Koncise Leadership Team

Customer Appreciation Golf Day

On-Site User Awareness Training

★★★★★

"Koncise acts as our trusted cybersecurity adviser. They conducted an in-depth phishing simulation exercise, providing us with a comprehensive report and strategic advice to enhance our defences. By working with Koncise to deploy a full intelligent email security platform, we simultaneously enhanced both our inbound and outbound defences. It's fantastic to work with a single provider that can do both - the process was incredibly easy and collaborative."

The Truth

It's not your fault.

If you're carrying cyber risk with limited time, limited resource, and a long list of competing priorities - you're not doing anything wrong. Most organisations are being held to enterprise expectations without the team, budget, or breathing space to match.

That's the gap we were built to fill.

Let's talk about your situation

Start with a Security Maturity Assessment

People, Process, Technology - mapped to NCSC CAF, NIST, and CIS. Built for IT Leaders, by people who understand your constraints.

Get Started

Questions We Hear a Lot

Real Questions, Straight Answers

We're a small IT team - are we too lean for Koncise to work with?

No - a lean IT team is exactly who we built our model for. We work alongside teams of one to ten IT staff managing infrastructure, end-user support, and security obligations simultaneously. Our job is to extend your capacity and close the gaps you do not have the time or headcount to close yourself.

How do you help IT Directors speak to boards about cyber risk?

We provide structured outputs - Security Maturity Assessments, risk registers, and prioritised roadmaps - that translate technical risk into board-relevant terms. We help IT Directors frame cyber risk in the language boards respond to: financial exposure, regulatory liability, and operational continuity. You leave with something documented and defensible, not just a verbal brief.

What does it actually mean to have a partner rather than a vendor?

It means we are invested in your security outcomes, not in closing the next sale. A vendor pushes product. A partner asks whether a product is right for you - and says no when it is not. Our 99% client retention rate is built on that distinction. When clients trust that our recommendations serve their interests, they stay - and they refer others.

How do you extend our team's capacity without replacing it?

We integrate as an extension of your team, not a layer above it. Our 24/7 MDR handles continuous monitoring and active response, freeing your team to focus on projects, architecture, and stakeholder work. For phishing simulation, vulnerability management, and compliance reporting, we provide execution depth that would be difficult to resource internally at equivalent breadth. You retain strategic control and vendor relationships - we handle the operational heavy lifting in the gaps.

Our tooling is already in place - can you work alongside what we have?

Yes. We regularly onboard clients who have existing endpoint, identity, or email security tooling in place. Our Security Maturity Assessment identifies where current tools are working well and where the gaps are - so we build on what you have rather than replace it wholesale. We are tool-agnostic where the security outcome allows.

Can Koncise work alongside our existing MSP or IT vendor?

Yes. Many of our clients already have an MSP or IT provider managing infrastructure, helpdesk, and day-to-day device management. Koncise sits alongside that relationship as a dedicated security layer - covering detection and response, human risk, identity protection, and compliance that most MSPs do not go deep on. We are clear about scope from the outset so there is no ambiguity or duplication between what Koncise covers and what the MSP covers.

How do you help Finance Leaders quantify the cost of cyber risk?

We frame cyber risk in financial terms: the potential cost of a ransomware incident, regulatory fines under GDPR for a data breach, and the operational downtime associated with common attack scenarios. This context is built into our assessment and roadmap outputs, giving Finance Leaders a basis for evaluating security investment as a business decision - not a technical line item.

When is it better to bring in a cybersecurity partner rather than hiring in-house first?

For most mid-market organisations, a managed partner delivers broader coverage, faster, and at lower total cost than building equivalent in-house capability from scratch. A single security hire gives you one specialism, limited working hours, and a single point of failure. A partner provides 24/7 coverage, multidisciplinary depth across MDR, compliance, phishing, and identity, and no recruitment risk - typically at a cost that compares favourably to a single experienced hire and their supporting tooling. Hiring in-house makes most sense once you have an established managed foundation and a clear head-of-security role to grow into. A partner like Koncise can help you get there.

What do insurers, auditors, and boards typically expect as evidence of good security?

Cyber insurers increasingly want documented evidence of specific controls: MFA on email and privileged accounts, active endpoint detection, a defined patch management process, tested backup and recovery, and a phishing awareness programme - with Cyber Essentials certification now commonly required or preferred. Auditors want framework alignment and testing evidence. Boards want to understand residual risk in business terms and see a structured plan for managing it. Our Security Maturity Assessment is designed to produce outputs that satisfy all three audiences in a form that is actually useful, not just technically correct.

How do we prioritise security improvements when budget only covers a few things?

Start by identifying your highest-probability and highest-impact risks - which is exactly what a Security Maturity Assessment establishes quickly and independently. In most mid-market environments, the three areas that deliver the most risk reduction per pound are: identity and access controls (MFA, privileged access), a managed detection and response capability, and a phishing simulation and awareness programme. From there, a prioritised roadmap gives you a defensible, sequenced plan for the next 12 to 24 months based on your actual posture - not a generic best-practice list.

We're facing an audit or compliance requirement - where do we start?

Start with a Security Maturity Assessment, which maps your posture against NCSC CAF, NIST CSF, CIS Controls, and ISO 27001. It produces a gap analysis and a prioritised roadmap with outputs designed to be presented directly to auditors, insurers, or boards - giving you a structured, evidence-backed path to audit readiness rather than a point-in-time snapshot.

Portfolio

The Koncise Portfolio

Designed for lean IT teams who need outcomes, not noise. Defence-in-depth without turning security into a second full-time job.

Live Security Sessions

The Koncise Team

Security Awareness Events

The Starting Point

Know where you stand before you spend.

If you're juggling tooling, incidents, and stakeholder expectations, you don't need another generic checklist. You need a baseline you can trust - and a clear view of what to prioritise next.

Know Where You Stand

A clear, evidence-led baseline across people, process, and technology - no guesswork, no hand-waving.

Prioritise What Matters

We translate findings into clear next steps: fix first, fix next, and what can wait until budget or resource allows.

Get Buy-In & Budget

Exec-friendly outputs that help you secure resource, justify spend, and move faster internally.

★★★★★

"As a fast-growing business, we needed a security solution that could scale with us and provide 24/7, year-round protection for our global network of people and data. Koncise worked closely with us from pre-sales to post-sales support, ensuring we were fully set up. It's great to have one less thing to worry about knowing that we have a team of cybersecurity experts hunting and responding to cyber threats on our behalf."

How We Improve Security

The Koncise Security Improvement Model

Understand it. Build it. Test it. Improve it. Prove it. The portfolio below is Step 02 - but it only works because of the four steps around it.

01

Assess

Know where you stand before you spend.

Maturity · Risk · Roadmap

02

Build

Build what’s actually missing.

The Security Portfolio

03

Test

Coverage built. Now let’s try to break it.

Technology · People · Process

04

Fix

Fix what testing proves matters.

Prioritised Improvement

05

Prove

Prove the improvement is real.

Retest · Measure · Evidence

Next time, the list is shorter.

Step 02 - Build

The Six Pillars of the Koncise Security Portfolio

Six specialisms, working together as one cohesive strategy. Most clients start with one or two and expand as budget and maturity allow.

01

Detect & Respond to Threats 24/7

Faster detection and containment. Less downtime. Clearer accountability.

When threats land - and they will - you need detection that doesn't sleep and response that doesn't wait for Monday morning. Our 24/7 MDR service monitors your environment around the clock, with human analysts and automated response working together to contain incidents before they escalate.

What this covers

24/7 MDRXDRNDRITDRUEBASIEM/SOARThreat HuntingAnti-RansomwareIncident ResponseManaged Risk

Who we work with

·

Security Validation asks

Would we actually see it - and would we respond?

Test your detection → Talk to us about this →

02

Stop Phishing & Human Risk

Fewer successful attacks. Stronger reporting culture. Measurable behaviour change.

Your people are both your biggest vulnerability and your strongest defence. We send over 30,000 simulated phishing emails per year on behalf of our clients - giving us deep insight into human risk patterns and what actually drives lasting behaviour change.

What this covers

Managed PhishingAI Cloud Email SecurityICESBEC ProtectionSecurity Email GatewayDMARCUser AwarenessBreach Simulation

Who we work with

·

·Koncise·

·

·Koncise·

·

Security Validation asks

Could someone successfully manipulate one of our people or processes?

Free Managed Phishing → Talk to us about this →

03

Secure Data & Prevent Loss

Reduced data exposure. Safer sharing. Stronger governance.

Data loss incidents are rarely dramatic. They're slow, silent, and costly. We help you understand where your data lives - across cloud, email, and endpoints - and make sure it stays there, with controls that don't get in the way of how people work.

What this covers

DSPMSecure Web ProxyCASBWeb/Email DLPeDiscoveryShadow IT Discovery

Who we work with

·

Security Validation asks

Can information be reached that shouldn’t be?

See how we test this → Talk to us about this →

04

Protect Identity & Access

Fewer account takeovers. Cleaner access control. Reduced privilege sprawl.

Identity is the new perimeter. Compromised credentials are the most common attack vector across every sector we work in. We lock this down with layered controls - from MFA and conditional access to full identity threat detection - without making your users' lives miserable.

What this covers

ITDRUEBAMFAConditional AccessZTNAPAMShadow IT

Who we work with

·

Security Validation asks

What can one compromised identity actually give an attacker?

How we test identity → Talk to us about this →

05

Patch, Harden & Reduce Attack Surface

Fewer exploitable gaps. Faster remediation. Better resilience.

Most breaches exploit known vulnerabilities. Staying ahead of your attack surface is unglamorous work - but it's where real resilience is built. We manage patching, harden configurations, and protect your data against loss and ransomware with enterprise-grade backup and disaster recovery.

What this covers

Vulnerability ManagementUEM/RMMDRaaSCloud BackupSecure Config ReviewsAttack Surface Management

Who we work with

·

Security Validation asks

What is exposed - and what is genuinely exploitable?

See penetration testing → Talk to us about this →

06

Assurance & Compliance

Board-ready evidence. Clear priorities. Audit confidence.

Compliance shouldn't be a box-ticking exercise - it should build real security. Our assessments give you an independent, evidence-backed view of where you stand and a roadmap that prioritises what to do next, turning security from a cost centre into a conversation you can have at board level with confidence.

What this covers

Maturity AssessmentSecurity RoadmapsVulnerability AssessmentMicrosoft Security ReviewTabletop ExercisesCyber EssentialsCyber Essentials Plus

Who we work with

Cyber Essentials·Cyber Essentials+·NIST CSF 2.0·ISO 27001·NCSC CAF· Cyber Essentials·Cyber Essentials+·NIST CSF 2.0·ISO 27001·NCSC CAF·

Security Validation asks

Can we evidence that things are getting better?

How we evidence improvement → Talk to us about this →

Beyond the Six Pillars

Broader technology needs, handled by the same trusted team.

07

Other Services

Broader technology needs, handled by the same trusted team.

Beyond the six core security pillars, Koncise supports your broader technology needs - from commercial licensing and hardware to emerging AI governance and fully outsourced IT operations. One team, one relationship, no gaps.

Hover to learn more

Competitive M365 LicensingAI Consultancy & DesignAgentic AI GovernanceHardware ProcurementData CentreOutsourced IT

Managed Firewalls·AWS·Digital Transformation Design & Implementation·Modern Workplace·Microsoft Licensing Optimisation·Competitive M365 Licensing·AI Consultancy & Design·Agentic AI Governance·Hardware Procurement·Data Centre·Outsourced IT· Managed Firewalls·AWS·Digital Transformation Design & Implementation·Modern Workplace·Microsoft Licensing Optimisation·Competitive M365 Licensing·AI Consultancy & Design·Agentic AI Governance·Hardware Procurement·Data Centre·Outsourced IT·

Talk to us about this →

Coverage built. Now let’s try to break it.

Step 03 - Test · Validation

Coverage built. Now let’s try to break it.

The six pillars are a set of controls you’ve chosen to trust. Validation is where we find out whether that trust is justified. We challenge the assumptions made during Build - across technology, people and process - and replace them with evidence.

Penetration Testing

Technology. External and internal infrastructure, web applications and APIs - tested for what can genuinely be reached and exploited.

Explore penetration testing →

Adversary Simulation

People and process. Social engineering, physical security testing and goal-led red team engagements where they genuinely add value.

Explore adversary simulation →

Detection Validation

Response. Whether your monitoring genuinely detects, escalates and acts on realistic attacker behaviour - or simply generates reports.

Explore detection validation →

What validation asks of each pillar

Testing isn’t a separate discipline bolted onto the side. It asks a direct question of every pillar you’ve invested in.

Detect & Respond

Would we actually see it - and would we respond?

Stop Phishing & Human Risk

Could someone successfully manipulate one of our people or processes?

Secure Data & Prevent Loss

Can information be reached that shouldn’t be?

Protect Identity & Access

What can one compromised identity actually give an attacker?

Patch, Harden & Reduce Attack Surface

What is exposed - and what is genuinely exploitable?

Assurance & Compliance

Can we evidence that things are getting better?

See how we test Scope a Penetration Test

Findings in hand. Now we prioritise.

Step 04 - Fix

Fix what testing proves matters.

Testing produces a list. The useful part is deciding what actually needs doing, and in what order. Findings feed straight back into the roadmap - and not every one of them costs money.

Configuration & hardening

A significant share of findings are resolved by changing something you already own. Where that’s true, we say so plainly rather than quoting for it.

People & process

Targeted coaching, awareness intervention, or a change to a process that turned out to be easier to talk your way past than anyone expected.

Detection & architecture

Tuning what already exists so it sees the right things, and changing the design where the weakness is structural rather than a setting.

The finding is the finding.

Every finding stands on its own. We report what we found, what it means and what needs to change - independently of whether you buy anything else from us. Where the fix is a configuration change that costs nothing, we’ll tell you. Where we can help, we’ll mention it once and leave the decision with you.

Your team can action the whole list themselves and the report is just as valid. That’s the point of it.

Improvements made. Now we prove it.

Step 05 - Prove

Step 05 - Prove · The Result

Where we take you.

The outcome of a complete security strategy isn't a stack of tools. It's an organisation that operates with clarity, confidence, and resilience.

Revenues Protected

Threats contained before they become incidents - and before they cost you.

Users Educated

30,000 simulated phishing emails per year gives us real insight into human risk and what drives lasting behaviour change.

Faster Time to Respond

Managed detection means less dwell time, a smaller blast radius, and a lower cost per incident.

Exec Sponsorship

Security moves from an IT concern to a board priority - with the language, reporting, and sign-off to match.

And the evidence to back it up

“It’s better now” isn’t a position you can take to a board, an insurer or an auditor. These are.

Retesting closes the loopFindings from a penetration test are retested so you can show a specific weakness was found, fixed and confirmed closed - not just ticked off a spreadsheet.
Repeat phishing simulations show behaviour changeSusceptibility and reporting rates measured over time. This is the clearest evidence most organisations have that awareness spend actually worked.
Detection validation, repeatedThe same controlled activity run again, showing whether the gaps in monitoring have genuinely been closed.
Maturity reassessmentThe same 100-question baseline, scored again. Movement across People, Process and Technology, mapped to the frameworks you report against.
Roadmap actions closedThe prioritised plan from Step 01, with items evidenced as complete rather than simply marked done.

Next time, the list is shorter.

Then we go back to the assessment and start again - from a stronger position than last time. That’s the whole point of the cycle.

Not sure where to start?

The Security Maturity Assessment is designed for exactly that moment. Let's find your baseline together.

Start a Conversation

Buyer Questions

Service & Fit Questions

Where should we start if we're not sure which services we need?

Start with a Security Maturity Assessment. It maps your current position across People, Process, and Technology, identifies the highest-priority gaps, and produces a roadmap you can act on - without committing to any specific tooling in advance. It is the fastest way to move from uncertainty to a clear, evidence-based plan.

Do we need MDR if we already have EDR or endpoint protection in place?

Probably yes - unless someone is actively monitoring, triaging, and responding to the alerts your EDR generates. EDR detects and blocks threats at the endpoint. MDR adds the human analyst layer that decides what is a genuine incident, investigates behaviour across your whole environment, and takes containment action in real time. Most mid-market organisations running EDR without managed response are generating alerts that nobody is consistently acting on - particularly outside business hours. MDR closes that gap.

When would you recommend MDR over expanding our internal security team?

In almost all mid-market scenarios. A single security hire provides daytime coverage in one location, a single area of specialism, and a single point of failure. MDR provides 24/7 analyst coverage across your entire environment, a collective team with experience across thousands of client environments, and active response from day one - at a cost that is typically lower than a single experienced hire and without the recruitment lead time. Internal headcount makes more sense once you have an established managed detection baseline to build on, not instead of it.

How long does MDR take to deploy, and when does it start delivering value?

Most MDR deployments reach active coverage within two to four weeks. Initial onboarding involves connecting your endpoint, identity, and network telemetry to the monitoring platform, establishing a behavioural baseline, and configuring response playbooks. Meaningful detection typically starts within the first week of going live. The service also gets more precise over time as it learns your environment and reduces false-positive noise - but day-one coverage is real, not theoretical.

What does phishing simulation actually improve in practice, and how quickly?

Consistent phishing simulation with immediate, contextual training reduces employee click rates and increases the rate at which employees report suspicious emails - which is the behaviour that matters most in a real attack. Most clients see measurable improvement within three to six months of a structured programme. We send over 30,000 simulated phishing emails per year on behalf of our clients, using scenarios matched to current threat trends. That volume gives us genuine insight into human risk patterns - what people click, what they report, and what actually changes behaviour over time. The goal is durable change, not a one-off test result to show an auditor.

Do we need DMARC if we already use Microsoft 365 or an email security gateway?

Yes. An email security gateway filters inbound threats coming to your organisation. DMARC is an outbound control - it prevents attackers from impersonating your domain when sending emails to your clients, suppliers, or employees. These solve different problems and are not alternatives to each other. Without DMARC enforcement, your domain can be trivially spoofed in phishing campaigns that your gateway has no visibility of. Microsoft 365 does not enforce DMARC for you by default - it needs to be configured and actively managed.

What is DSPM and when is it relevant for a mid-market organisation?

Data Security Posture Management (DSPM) discovers, classifies, and monitors sensitive data across your environment - including cloud storage, collaboration platforms, and email. It becomes relevant when your SaaS and cloud footprint has grown to the point where you are no longer certain where sensitive data lives, who has access to it, or whether it is appropriately controlled. For organisations with GDPR obligations or sector-specific data requirements, DSPM provides the visibility needed to manage those obligations with confidence rather than assumption.

When should identity protection be a higher priority than endpoint security?

Identity should lead your roadmap when most of your workforce is remote or hybrid, when you are heavily reliant on cloud and SaaS applications, or when a recent audit or incident has highlighted credential-based risk. The majority of breaches involve compromised credentials, not exploited endpoints - which is why identity is widely considered the new perimeter. If you have MFA gaps, privileged access issues, or limited visibility of shadow IT and lateral movement, identity protection addresses a higher-probability risk than additional endpoint tooling.

What does a Security Maturity Assessment give us that a compliance audit doesn't?

A compliance audit checks whether specific controls are in place for a defined standard at a point in time - it gives you a pass or fail against a fixed list. A Security Maturity Assessment maps your actual security posture across People, Process, and Technology, scores it against multiple frameworks, identifies root causes of gaps, and produces a prioritised roadmap for improvement. It tells you not just where you fall short, but why - and what to fix first based on real risk, not just checklist order. The output is a planning and investment tool, not just a certificate.

How do we know if Cyber Essentials is enough, or whether we need a broader programme?

Cyber Essentials is a solid baseline that is increasingly required by insurers and public sector supply chains, and it is the right first certification for most mid-market organisations. But it covers five specific technical controls and does not address continuous threat detection, incident response, human risk, data security, or long-term security governance. If you have achieved Cyber Essentials and are asking what comes next, a Security Maturity Assessment will map the gaps between your current posture and the level of protection your threat exposure actually warrants.

What should be in place before going for Cyber Essentials Plus?

Cyber Essentials Plus adds independent technical verification of the same five controls in the standard certification, so those controls need to be genuinely implemented and evidenced - not just documented. The most common failure points are: unpatched software or unsupported operating systems on in-scope devices, overprivileged user accounts or incomplete MFA rollout, and firewall configurations that do not match the assertion made in the base certification. A pre-Plus readiness review from Koncise identifies and resolves these gaps before the formal assessment - which is more efficient than failing and reapplying.

Which services are typically the right first step for organisations at different stages?

For organisations with no formal programme, the starting point is a Security Maturity Assessment followed by MDR and phishing simulation - detection, response, and human risk addressed in parallel. For those with some controls in place, priority shifts to closing the highest-risk gaps identified in an assessment: typically identity and access controls, DMARC, or compliance evidence for insurers. For more mature organisations, the focus moves to advanced detection, data security posture, pen testing, and resilience. The right sequence depends on your specific risk profile, sector obligations, and existing investments - which is why the assessment comes first.

What compliance frameworks does Koncise cover?

We work across NCSC Cyber Essentials and Cyber Essentials Plus, NCSC CAF, NIST CSF, CIS Controls v8, ISO 27001, and GDPR-related data protection requirements. Our assessment and compliance services are designed to produce outputs usable across multiple frameworks simultaneously - so a Security Maturity Assessment report can inform Cyber Essentials readiness, ISO 27001 gap analysis, and board-level risk reporting at the same time.

How do the six service pillars work together as a joined-up strategy?

The six pillars address the full attack lifecycle. Detect & Respond handles real-time threat detection and active containment. Stop Phishing & Human Risk addresses the human attack surface. Secure Data & Prevent Loss controls what leaves your environment. Protect Identity & Access locks down the most commonly exploited attack vector. Patch, Harden & Reduce Attack Surface removes the vulnerabilities attackers rely on. Assurance & Compliance gives you evidence, accountability, and a forward roadmap. Most clients do not address all six from day one - but each pillar is designed to layer with the others, so every area you add strengthens the ones already in place.

Which vendors and technologies do you work with?

We work with a carefully selected portfolio of best-in-class vendors across each area of our security practice. We are vendor-agnostic - we recommend based on what fits your environment, risk profile, and budget, not on margin or reseller incentives.

Detect & Respond 24/7

N-able, CrowdStrike, Arctic Wolf, Rapid7, Halcyon, Sophos

Phishing & Human Risk

Koncise Managed Phishing Service, Koncise Cyber Academy Online User Training, KnowBe4, Abnormal, Egress, Mimecast, Sendmarc, Redsift

Data Security & Prevention

Dope Security, KnowBe4, SimplyDiscover, Proofpoint

Identity & Access

Ploy, Okta, ZeroFox

Patch, Protect & Harden

N-able, CrowdStrike, Sophos, Automox, Tenable, Traced

Compliance & Resilience

Koncise Security Maturity Assessment, CyberSmart

Security Validation

Find Out Whether Your Security Actually Works

You’ve invested in tools, controls and services. Validation is how you find out whether they hold. We test the technology, the people and the processes around them - and give you evidence instead of assumptions.

Talk to a Tester Explore Penetration Testing

The Difference

Assurance tells you what should be true.
Validation tells you what is.

Both matter, at different points. One gives you breadth. The other gives you certainty about a much narrower slice. Most organisations need both, and confusing them is how gaps survive an audit.

Assurance

We examine it

A structured review of your configuration, policies and controls against what good looks like. Thorough, low-risk, and it covers everything - a Security Maturity Assessment, a Microsoft Security Review, a vulnerability assessment. It tells you where you stand on paper.

Validation

We try to break it

Narrower by design. We ignore the documentation and try to achieve something - reach a system, compromise an account, talk our way past a process. It only reports what we actually found. But what it finds is real, and it’s evidence.

Where This Fits

Step 03 of the Security Improvement Model

Validation isn’t a standalone purchase. It sits between building your security and proving it improved - and it’s what makes the last step possible.

01

Assess

Know where you stand before you spend.

02

Build

Build what’s actually missing.

03

Test

Coverage built. Now let’s try to break it.

04

Fix

Fix what testing proves matters.

05

Prove

Prove the improvement is real.

Next time, the list is shorter.

How We Test

Three ways to find out.

Which one you need depends on the question you’re trying to answer. We’ll tell you honestly which that is - including when the answer is “not this one yet”.

Penetration Testing

Networks · Infrastructure · Web Applications · APIs

Scoped technical testing of a defined environment. Answers: where are the weaknesses here, and what can actually be done with them?

Explore penetration testing →

Adversary Simulation

People · Physical · Technical

Goal-led testing that uses whichever route works. Answers: could someone actually achieve this - and would we notice?

Explore adversary simulation →

Detection Validation

MDR · EDR · SIEM · Response

Testing the defender rather than the attack. Answers: if this happened, would anyone have seen it in time?

Explore detection validation →

Broader Than Penetration Testing

Technology, people and process.

Attackers don’t restrict themselves to your infrastructure, so validation shouldn’t either. Some of this is new capability. Some of it Koncise has been delivering for years.

Technology

External and internal penetration testing, web application and API testing, detection validation, and confirming whether known vulnerabilities are genuinely exploitable in your environment.

People

Managed Phishing simulations, targeted social engineering, and user-awareness testing. We send over 30,000 simulated phishing emails a year on behalf of clients - this part isn’t new.

Process

Tabletop exercises, incident-response walkthroughs, physical security testing, and testing whether the process someone is supposed to follow actually holds under pressure.

Managed Phishing is validation too

It’s worth being clear that Koncise has been running an improvement model for years without calling it one. Managed Phishing establishes a baseline, awareness intervention improves it, the next simulation tests whether it worked, and the susceptibility and reporting rates prove whether behaviour genuinely changed.

That’s Assess, Build, Test, Fix and Prove - applied to people rather than infrastructure. The offensive security capability extends the same logic to technology.

See Managed Phishing →

Connected To Everything Else

What validation asks of each pillar

This is the part a standalone testing firm can’t easily do. Because we already work across these areas, testing asks a direct question of the coverage you’ve built - and the findings land somewhere useful.

Detect & Respond

Would we actually see it - and would we respond?

Stop Phishing & Human Risk

Could someone successfully manipulate one of our people or processes?

Secure Data & Prevent Loss

Can information be reached that shouldn’t be?

Protect Identity & Access

What can one compromised identity actually give an attacker?

Patch, Harden & Reduce Attack Surface

What is exposed - and what is genuinely exploitable?

Assurance & Compliance

Can we evidence that things are getting better?

Independence

The finding is the finding.

We both test and remediate, so it’s reasonable to ask whether that shapes what we report. Here’s our position, in writing.

Findings stand on their ownEvery finding is complete and actionable without reference to anything Koncise sells. If it only makes sense as a reason to buy something, it isn’t a finding.
We recommend the outcome, not the productRemediation advice describes the security outcome required. Where a specific technology is genuinely the answer, we’ll say so - but the recommendation is written so any competent provider could act on it.
Free fixes are called out as freeA significant share of what we find is resolved by changing a setting on something you already own. When that’s the case, we say so plainly rather than quoting for it.
Koncise support is optional and separateWhere we can help, it’s flagged once, in its own section, and clearly marked as optional. Your team actioning the whole list themselves is a perfectly good outcome.
The report should be portableYou should be able to hand it to another provider and have it be just as useful. If it isn’t, we haven’t written it properly.

What Happens Next

Testing shouldn’t end at a PDF.

A report that gets filed hasn’t improved anything. The value is in what happens over the following weeks.

Test

We scope it properly, carry out the work, and walk you through what we found in a session with the people who did the testing - not a summary passed down a chain.

Fix

Findings are prioritised by what an attacker could realistically do with them. Some are configuration changes. Some are process changes. Some need proper project work.

Prove

Retesting confirms specific findings are genuinely closed, so you have evidence of improvement rather than an assurance that someone got round to it.

Want to know if it actually holds?

Tell us what you're trying to find out and we'll tell you which kind of testing answers it - including when the honest answer is that you don't need us yet.

Talk to a Tester Scope a Penetration Test

Tested, not assumed.

← Security Validation

Penetration Testing, Delivered by Our Own Team

We test the way an attacker would - from the internet, from inside your network, and through your applications and APIs. You get a prioritised list of what genuinely needs fixing, written so your engineers and your board can both read it.

Scope a Penetration Test Talk to a Tester

External Internal Web Application API

The Starting Point

Questions worth asking.

If you can answer all of these with evidence rather than expectation, you probably don't need a test right now. Most organisations can't.

What can somebody on the internet actually reach today?
If one user account were compromised, how far could an attacker get?
Are the vulnerabilities on your scan report genuinely exploitable, or simply present?
Could a minor weakness in one system be chained with another into something serious?
Would your existing controls stop what our testers do - or just record it afterwards?
When did anyone last verify this, rather than assume it?

The Distinction

Scanning finds known weaknesses.
Testing shows you how they can actually be used.

This is not an argument against vulnerability scanning. We run it as a managed service and it does a job nothing else does - breadth, frequency, and consistency across a whole estate. But it answers a different question.

Vulnerability Scanning

Broad, automated, frequent

Checks your estate against a database of known issues and returns everything it recognises, ranked by a generic severity score. Excellent for coverage and for tracking whether patching is keeping up. It runs weekly without anyone thinking about it.

Penetration Testing

Narrow, manual, contextual

A tester works out which of those issues matter in your environment, whether they can genuinely be exploited, and what happens when three unremarkable ones are chained together. It finds logic flaws no scanner has a signature for.

A scanner might return four hundred findings. A tester tells you which one gets someone to domain admin, and which three hundred can wait. Both have a place, and most organisations should be doing both.

What We Test

Four kinds of engagement.

Most organisations start with external, then internal. Which combination is right depends on what you're trying to establish - we'll talk it through before quoting anything.

01 - External

External Penetration Testing

What could somebody on the internet actually reach and exploit?

We work from the same position as an anonymous attacker: outside your network, with no credentials and no inside knowledge. We map what's genuinely exposed - which is regularly more than organisations expect, particularly where services have been stood up temporarily and quietly stayed - and then establish what can be done with it.

This is usually the right first engagement. It reflects how most opportunistic attacks begin, and it tends to produce the findings that matter most immediately.

Internet-facing infrastructure Exposed services Remote access Perimeter configuration Credential exposure

02 - Internal

Internal Penetration Testing

If an attacker or compromised user were already inside, how far could they go?

We start from a position most organisations should assume is achievable - a single compromised device or user account - and establish what that actually gets someone. This is where the gap between an organisation's assumed security and its real security is usually widest, because internal networks are frequently built on trust that was reasonable a decade ago.

Findings here tend to be about privilege, segmentation and identity rather than missing patches, and they're often the ones that turn a contained incident into a serious one.

Lateral movement Privilege escalation Active Directory Network segmentation Service accounts Credential handling

03 - Web Application

Web Application Penetration Testing

Can someone do something in your application they shouldn't be able to?

Manual testing of the application itself - authentication, authorisation, session handling, input handling and business logic. Logic flaws are the ones automated tooling reliably misses, because there is nothing malformed about a request that simply asks for someone else's data using a valid session.

We test with multiple privilege levels wherever the application supports them, because most meaningful application findings involve one role reaching something intended for another.

Authentication Authorisation Business logic Input handling Session management Sensitive data exposure

04 - API

API Penetration Testing

Does the API enforce what the interface in front of it implies?

APIs are frequently built assuming the client application will behave, and tested through that same client. We test them directly. The recurring finding is broken object-level authorisation - where changing an identifier in a request returns data belonging to somebody else, because the check happened in the front end rather than behind it.

We also look at how the API behaves when used at volume or in an order the developers didn't anticipate, which is where abuse of otherwise-correct logic tends to appear.

Authentication Object-level authorisation Data exposure Rate limiting & abuse Business logic

How It Runs

A test you can plan around.

No surprises about timing, access or disruption. Everything is agreed in writing before anyone touches anything.

ScopingA conversation, not a form. We establish what you're trying to find out, what's in scope, what's explicitly out of scope, and any systems that need careful handling. You get a written scope and a fixed quote before anything begins.
Rules of engagementAgreed in writing: testing windows, what we will and won't attempt, named contacts on both sides, and a defined process for stopping immediately if anything unexpected happens.
TestingCarried out by our own security testing team within the agreed window. If we find something critical, you hear about it while we're still testing - not weeks later when the report arrives.
ReportingA written report covering what we found, how we found it, what an attacker could do with it, and what needs to change. Prioritised by real-world impact rather than raw severity score.
DebriefA session with the people who did the testing, so your team can ask questions properly. We'll go as technical as your team wants, and we'll do a separate non-technical version for leadership if that's useful.
RetestingOnce you've made the changes, we verify the specific findings are genuinely closed - so you have evidence, not an assumption.

What You Receive

A report someone will actually read.

Reporting is where most testing engagements quietly fail. A technically excellent test written up badly produces no improvement at all.

Evidenced

Every finding shows what we did and what happened. Not a severity label and a link to a CVE, but the actual steps, so your team can reproduce it and confirm the fix worked.

Prioritised

Ordered by what an attacker could realistically achieve in your environment. A theoretical critical that requires physical access ranks below a medium that hands over an admin account.

Readable at both levels

A technical body your engineers can work from, and a summary that explains business exposure without jargon - so the same document works in a stand-up and in a board pack.

The finding is the finding.

We both test and remediate, so it's fair to ask whether that shapes what we report. Our position: every finding is complete and actionable without reference to anything Koncise sells. Remediation advice describes the security outcome required, written so any competent provider could act on it.

Where something is fixed by changing a setting on a product you already own, we say so plainly rather than quoting for it. Where we can help, it's flagged once and clearly marked optional. You should be able to hand the report to another provider and have it be just as useful.

Afterwards

Most testing stops at the report. Ours doesn't have to.

This is the practical advantage of testing being one part of a wider security practice rather than the whole business.

We understand the context

Our testers work alongside the teams running MDR, identity, email security and patching for organisations like yours. A finding gets interpreted against how these environments actually behave, not in isolation.

We can help fix it

If you want support with remediation, we can provide it. If your team would rather action it themselves, the report is written so they can. Both are entirely normal outcomes.

We can prove it's closed

Retesting confirms the specific findings are resolved. That's what turns a test into evidence you can show an insurer, an auditor or a board.

Scoping

What affects the size of an engagement

We don't publish price lists, because a number without scope behind it is meaningless. These are the things we'll discuss with you to establish what a test involves.

Scale

How many live hosts, IP ranges or applications are genuinely in scope. Usually smaller than the initial estimate once we've talked it through.

Complexity

How many distinct user roles an application supports, how much custom logic sits behind it, and how many APIs are exposed.

Access & constraints

Whether testing is authenticated, which credentials are provided, and any restrictions on timing, systems or techniques.

If you're working to a deadline - an insurance renewal, a client requirement, an audit - tell us early. It changes how we sequence things.

Common Questions

Penetration Testing FAQs

What is the difference between a penetration test and a vulnerability scan?

A vulnerability scan is automated and checks your systems against a database of known issues, returning everything it recognises ranked by a generic severity score. A penetration test is carried out manually by a tester who establishes which of those issues can genuinely be exploited in your environment, what an attacker could achieve with them, and what happens when several minor issues are chained together. Scanning gives you breadth and frequency. Testing gives you context and proof. Most organisations benefit from both.

Do you carry out testing yourselves, or subcontract it?

Testing is delivered by our own security testing team. The people who scope the engagement with you are the people who carry out the work and walk you through the findings afterwards. It means findings can be discussed properly rather than relayed through a third party, and the people who found the problem can help you understand what to do about it.

Should we start with an external or internal penetration test?

External is the usual starting point. It reflects how most opportunistic attacks begin, it requires less coordination from your team, and it tends to surface the findings that matter most immediately. Internal testing typically follows, and answers a different and equally important question: what one compromised account or device would actually give an attacker. Organisations with a mature external position often find internal testing more valuable, because that is where assumed security and real security diverge most.

Will testing disrupt our systems or our users?

Testing is carried out within an agreed window under written rules of engagement that define what we will and will not attempt. Any system needing careful handling is identified during scoping and treated accordingly. There is a named contact on both sides throughout and a defined process for stopping immediately if anything unexpected occurs. Disruption is rare, and where a technique carries genuine risk we agree in advance whether it is in scope at all.

How long does a penetration test take?

It depends on scope, which is exactly why we scope properly before quoting. A focused external test of a small estate is a short engagement; a large internal network or a complex application with several user roles takes considerably longer. You will have a written scope, a fixed quote and an agreed timeline before any work begins, so there are no surprises on duration or cost.

What do we actually get at the end?

A written report covering every finding with the evidence behind it, what an attacker could do with it, and what needs to change - prioritised by realistic impact rather than raw severity score. Alongside that, a debrief session with the testers who did the work so your team can ask questions directly. Where useful we also provide a non-technical summary suitable for leadership or a board.

Do you retest after we have fixed the findings?

Yes. Once remediation is complete we verify that the specific findings are genuinely closed, so you have evidence rather than an assumption. This matters more than it sounds: a fix that was applied to one system but not its three siblings is a common and easily missed outcome. Retesting arrangements are agreed as part of scoping.

Doesn't testing just create a sales opportunity for you?

It is a fair question to ask of anyone who both tests and remediates. Our position is that the finding is the finding: every finding is complete and actionable without reference to anything Koncise sells, and remediation advice describes the security outcome required rather than a product. Where something is fixed by a configuration change that costs nothing, we say so. Where we can help, we mention it once and leave the decision with you. You should be able to hand our report to any provider and have it be just as useful.

We need a test for an insurance renewal or client requirement. Can you work to a deadline?

Usually, but tell us early. Compliance and insurance-driven testing is date-bound in a way that discretionary testing is not, and knowing the deadline at the point of scoping changes how we sequence the work. It also helps us tell you honestly whether the deadline is achievable, which is more useful than agreeing to it and finding out later.

Ready to find out what actually holds?

Tell us what you're trying to establish and we'll scope it properly. No obligation, and no quote until we both understand what's involved.

Scope a Penetration Test Talk to a Tester

Tested, not assumed.

← Security Validation

Adversary Simulation

A penetration test asks where the weaknesses are in a defined environment. Adversary simulation asks something harder: could someone actually achieve a real objective - and would anyone notice while they did it?

Talk to a Tester Compare with Penetration Testing

Social Engineering Physical Security Red Team

The Distinction

Scoped to a goal, not to a system.

The difference matters commercially as well as technically, because the two produce very different reports and answer very different questions.

Penetration Testing

“Where are the weaknesses in this?”

Scoped to a defined thing - this network, this application, this range. We test it systematically and tell you everything we find in it. You get breadth and a comprehensive list.

Adversary Simulation

“Could someone actually get to what matters?”

Scoped to an objective - reach the finance system, obtain that dataset, get into the building. We use whichever route works: a technical weakness, a convincing phone call, or a door somebody holds open. Fewer findings, but they tend to be the ones that matter.

One is a survey of a defined area. The other is a rehearsal of something specific going wrong. Both are useful; they are not substitutes for one another.

What This Covers

People, physical and technical.

Attackers use whichever of these is easiest on the day. In practice that is very often not the technical route.

02 - Physical

Physical Security Testing

Could somebody simply walk in?

Testing whether physical access controls hold in practice - reception processes, access points, tailgating, visitor handling, and what an unaccompanied person could reach once inside. Physical routes are frequently the least tested and most reliable way into an organisation, particularly across multiple sites where process consistency is difficult to maintain.

Scope, sites, timing and authorisation are agreed in detail before anything happens, and testers carry written authorisation throughout. This work is arranged case by case rather than as a standard package, so talk to us about what you're trying to establish and we'll tell you plainly what we can cover.

Access points Tailgating Reception & visitor process Internal reachability

03 - Full Scope

Red Team Engagements

Would a determined attacker taking their time get what they came for?

A full-scope, objective-led engagement combining technical, human and where appropriate physical routes, conducted over an extended period with a small number of people inside your organisation aware it is happening. It tests your detection and response as much as your controls, because the point is not only whether someone gets in but whether anyone notices while they do.

Most organisations don't need a red team.

We'd rather say this plainly than sell you one. A red team engagement is the right answer when you already have detection and response you broadly trust, you've had penetration testing before, and you want to know whether it all holds against someone patient and creative.

If you haven't had a penetration test yet, start there. You'll get considerably more findings for less money, and a red team would largely tell you what a penetration test would have - only slower and at greater expense. We'll tell you during scoping if we think that's the case.

Start with penetration testing →

Is This For You?

When simulation is worth it.

Adversary simulation is a more advanced engagement than most organisations need first. These are the signals that it's genuinely the right next step.

You've had penetration testing before and acted on the findings.
You have detection and response in place that you'd like tested properly.
Your concern is a specific scenario rather than general weakness.
You need to know whether people and process hold, not just technology.
You have multiple sites where process consistency is hard to verify.
Leadership has asked a question that a vulnerability list won't answer.

If none of these sound like you yet, that's genuinely useful to know - and we'll point you at the thing that would help more.

What You Receive

A narrative, not just a list.

Because these engagements follow a path rather than survey an area, the report is structured differently to a penetration test.

The route we tookA step-by-step account of what we attempted, what worked, what didn't, and where we were stopped. This is often more instructive than the findings themselves.
What was and wasn't detectedA timeline of our activity against what your monitoring and your people actually picked up - including anything spotted and correctly escalated.
Process findings, not individual blameWhere a person was involved, we report the process that allowed it. Naming individuals produces defensiveness rather than improvement.
What needs to changePrioritised recommendations covering technology, process and people, written so any competent provider could act on them.
A debrief with the team who did itThese engagements generate a lot of context that doesn't fit neatly in a document. The conversation afterwards is usually where the value lands.

The finding is the finding.

As with all our testing: findings stand on their own, remediation advice describes the security outcome required rather than a product, and where something is fixed at no cost we say so. Where we can help, we mention it once and leave the decision with you.

Not sure which you actually need?

Tell us what you're trying to find out. We'll tell you honestly whether this is the right engagement - or whether something simpler would answer it better.

Talk to a Tester See All Security Validation

Tested, not assumed.

-- Days

|

-- Hours

|

-- Mins

|

-- Secs

Thursday 2nd July 2026

London
Security
Social

The Happenstance, 10 Paternoster Square · London · Free to Attend

This Quarter's Guest Speakers Include

The Security Social is heading to London. Come join the community, network with your peers, and hear from expert guest speakers on how to stay ahead of the curve in the ever-evolving cyber threat landscape. Connect with fellow IT leaders and security professionals at the upcoming, free to attend London Security Social.

Free to Attend · Cybersecurity Event

The Line-Up

Date: Thursday 2nd July 2026

Venue: The Happenstance, 10 Paternoster Square, London, EC4M 7DX

Social: Fairgame City, London

Duration: 11:30am – 6:30pm

Full Agenda:

11:30 – 12:15
Arrival & NetworkingLunch will be served throughout the day
12:15 – 12:20
Welcome & IntroBen Konopinski · CEO, Koncise Solutions
12:20 – 12:45
Keeping it Koncise: Introduction to New Security ServicesMax Harper (CCO) & Josh Broadbent (CTO) · Koncise Solutions
12:45 – 13:15
Customer Panel – Lessons from the FrontlineBenn White (Videndum), Mason Barendrecht (Hales Group) & +1 TBC · Hosted by Stephen Dorling
13:45 – 14:15
Attackers Don't Sleep: 24/7 Threat Detection & ResponseSpiros Papageorgiou · CrowdStrike
14:15 – 14:45
Fly-Direct: Cutting Out the Stopover in Secure Web Accessdope.security
14:45 – 15:15
The Enemy in Your Inbox: Outsmarting Modern Email AttacksAbnormal Security
15:15 – 15:20
Closing
15:20 – 15:30
Short Walk to Fairgame CityOptional
15:30 – 17:00
Networking & DrinksFairgame City
17:00 – 18:30
Unlimited Games at FairgamePrizes for top 3 · Fairgame City

Secure Your Spot Today

London Security Social

Speaker Features

Our partners and this event's line-up includes:

Customer Panel

Live Sessions

Real Conversations

Think you've got what it takes?

After the sessions we head to Fairgame City - unlimited games, fierce competition, and prizes for the top 3 on the leaderboard, sponsored by Koncise Solutions.

London Security Social

Common Questions

What is the London Security Social?

The London Security Social is a free, community-led cybersecurity event bringing together IT leaders, security professionals, and senior business decision-makers from across London. Expect expert speaker sessions on the threats organisations are facing right now, honest peer conversations you won't find on the vendor circuit, and genuine networking with people who share your challenges. It's part of the wider Security Social community Koncise has been running across the UK.

Do I need to be a Koncise Solutions customer to attend?

Not at all. The London Security Social is open to anyone in IT, security, or senior business leadership - whether you're an existing Koncise client or have never heard of us before today. We'd love for you to become part of the Koncise client community one day, but there's absolutely no pressure. Come for the conversations, the community, and the content. That's what the event is for.

Is it really free to attend?

Yes, completely free. No ticket price, no catch, no hard sell on the day. Places are limited, so we ask you to register in advance - but there's no cost to you whatsoever. What you'll leave with is worth far more than a conference fee.

Who should come to the London Security Social?

IT Directors, CISOs, Infrastructure Managers, Information Security Managers, and senior business leaders who want to stay ahead of the cyber threat landscape. If you're responsible for security decisions - or you're a security professional who values honest peer conversation over the usual marketing noise - you'll feel right at home.

What will be covered on the day?

This edition covers email security, offensive attacker methodologies (straight from a real hacking practitioner), secure web access, and 24/7 threat detection and response - plus an unscripted customer panel sharing real lessons from the frontline. The full agenda is above. Expect practical insight you can actually use, not theoretical frameworks.

Is there a cybersecurity networking community in London I can join?

The Security Social is exactly that community. We run regular events across the UK bringing IT and security leaders together for candid, peer-led conversations about the threats that actually matter. The London Security Social is our newest chapter - and it's already a place where real connections form, knowledge gets shared, and people leave sharper than when they arrived.

What happens after the formal sessions finish?

After the closing session there's a short walk to Fairgame City near St Paul's for drinks, networking, and unlimited competitive games - with prizes for the top 3 on the leaderboard, sponsored by Koncise Solutions. It's consistently the highlight of the day.

Events

Security knowledge should be shared, not hoarded.

We bring together IT leaders, security practitioners, and curious minds for practical conversations about the threats that actually matter.

Koncise Curry Club

Customer Panel

Suffolk Chamber of Commerce

Event Series

13 events hosted. More coming.

Fresh venues, great speakers, and proper takeaways. No death-by-PowerPoint, no vendor pitches dressed as content.

Flagship Series

Suffolk Security Social

Our flagship security networking event brings together IT and security leaders across East Anglia for candid conversations about real threats, practical defences, and the human side of security.

Suffolk & East Anglia IT Leaders & Security Pros

Community Event

The Curry Club

Seven editions in and counting. Part networking, part knowledge-sharing, entirely enjoyable. Good food, good people, and an honest conversation about where security is heading.

Various Locations 7 Events Hosted

Executive Briefing

Board-Level Security Conversations

Smaller, more intimate sessions designed for C-suite and senior leadership. The focus is on articulating security risk in business terms - and giving executives the language to lead on it.

C-Suite & IT Directors Strategic Focus

New Series

Cybersecuri-tee Golf Club

Don't get stuck in a cyber bunker. Relaxed rounds at great courses across the region - free to attend, no pitch on the fairway, just honest conversation between holes.

Various Courses IT Leaders & Senior Decision-Makers

Find out more →

Next Events Coming Soon

We're lining up fresh venues, great speakers, and sessions worth attending. New dates dropping soon.

Get notified

Want to attend or partner on an event?

Get in touch and we'll let you know what's next.

Contact Us

About Our Events

Event Questions

Which Koncise event format is right for me?

It depends on your role and what you want from it. The Suffolk Security Social suits IT Directors, ISMs, and security-aware IT managers who want peer conversation about real threats and practical defences in an informal setting. The Curry Club is best for those who prefer a relaxed dinner format - broader in attendance, with a security thread running through it. Board-Level Security Conversations are specifically for C-suite executives, senior IT leaders, and non-executives who need to engage with cyber risk at a governance level, without a deep technical background.

Do you need to be an existing client to attend?

No. Koncise events are open to IT leaders and senior business professionals whether or not they are existing clients. They are designed to facilitate honest, peer-level conversation - not to create a captive audience for a sales pitch. If you are working through security challenges and want to compare notes with people in similar roles, you are welcome.

Is attending worthwhile if we're not actively looking to buy security services?

Yes - and that is by design. Many regular attendees are not Koncise clients and are not currently evaluating anything. They come because the conversation is genuinely useful: honest peer exchange, current threat context, and practical discussion about what is actually working in mid-market security. There is no follow-up pressure, no lead capture disguised as a sign-in, and no pitch at the end. The value is in the room.

What makes these events different from vendor-led security briefings?

Koncise events are practitioner-led, deliberately small, and structured around conversation rather than presentation. There is no sponsored keynote, no product demo, and no hard sell. The goal is a space where IT leaders and executives can share real experiences, ask unfiltered questions, and leave with insight they can actually use. Attendees consistently cite the candour of the conversations as what sets them apart from the standard vendor circuit.

Do attendees leave with practical takeaways or mainly networking?

Both - but the practical dimension is intentional, not incidental. Sessions are built around real scenarios: current threat trends, decisions IT leaders are actively facing, and what is and is not working in practice. Attendees regularly leave with specific actions or perspectives they can apply. The networking reinforces that - it is a useful byproduct of putting the right people in a room for an honest conversation, rather than the main event.

What is the Suffolk Security Social and who should attend?

The Suffolk Security Social is Koncise's flagship event series, bringing together IT and security professionals from across East Anglia for an evening of peer conversation about the current threat landscape and practical defences. It suits IT Directors, ISMs, and Infrastructure Managers who want to compare notes with peers in a candid, informal setting - without a vendor agenda attached. Thirteen editions hosted and counting.

What are the board-level briefing sessions and who are they for?

Board-Level Security Conversations are intimate sessions designed for C-suite executives, senior IT leaders, and non-executive directors who need to engage with cyber risk without deep technical background. The focus is on governance, strategic decision-making, regulatory liability, and how to evaluate security investment at board level. Sessions are kept small by design to enable genuinely open discussion.

How can my organisation get involved or partner on an event?

Get in touch via the contact page and let us know your interest. We work with a small number of event partners and are open to conversations about co-hosting or sponsorship where there is genuine alignment of audience and purpose. We do not take commercial partnerships that would compromise the independence or quality of the content.

Event Series

Koncise Cybersecuri-tee Golf Club

Don't get stuck in a cyber bunker. Score a hole in one on your cybersecurity strategy with a trusted partner by your side.

Josh Broadbent, CTO of Koncise Solutions, on the golf course

Koncise Cybersecuri-tee Golf Club

About the Club

A relaxed round. A serious conversation.

We find it's a great way to get to know clients in a more informal environment. Luckily, we're better at our day jobs than we are as golfers.

The Koncise Cybersecuri-tee Golf Club is open to IT leaders, security professionals, and senior business decision-makers. No vendor pitches on the fairway - just honest conversation, a good walk, and the occasional shanked iron.

Register Your Interest

Ready to tee off?

Register your interest above or get in touch with the team directly.

Contact Us

Contact

Let's have a real conversation.

No autoresponders. No generic pitches. A personal reply from a real human - with a couple of sensible questions.

Get Started

Tell us about your situation

Ben Konopinski CEO & Founder, Koncise

"For 14 years, we've operated on one principle: do right by customers, even when it conflicts with short-term revenue."

Email info@koncisesolutions.com

Phone +44 (0) 20 7078 0789

Borehamwood HQ Koncise Solutions
2 Theobald Court
Borehamwood
Hertfordshire
WD6 4RN

Ipswich Office Koncise Solutions
Brightwell Barns, Ipswich Road
Ipswich, Martlesham
Suffolk
IP10 0BJ

Hours Mon–Fri 9am–5pm

A personal reply No autoresponders - we'll come back with a thoughtful reply and a couple of sensible questions.

No pressure, ever We'll listen first, keep it simple, and you'll never be pushed into something you don't need.

Clear direction, even if it's not us If we're not the right fit, we'll say so - and still point you towards the most practical next step.

★★★★★

"Ben and his team are extremely customer-focused and pride themselves on forming strong relationships. They advise in an impartial way - genuinely second to none."

Before You Get in Touch

What to Expect

What happens after we submit the contact form?

You will receive a personal reply from a member of the Koncise team - not an automated acknowledgement, not a BDR following a script. We aim to respond within one business day with a small number of thoughtful questions to understand your situation properly before suggesting any next steps.

We're not sure exactly what we need - is that okay?

Completely. The majority of first conversations we have are with people who know they have a challenge but are not yet sure where to focus. You do not need to arrive with a brief or a budget. We will help you shape one - and if a Security Maturity Assessment is the right first step, we will tell you that clearly and explain what it involves.

What should we prepare before the first conversation?

Very little. It helps to have a rough sense of your current setup - what security tools are in place, how many users you have, and the specific pressure point that prompted you to reach out, whether that is an insurer, an audit, a recent incident, or simply a feeling that your current approach is not keeping pace. If you do not have that to hand, the conversation will get you there. We ask good questions.

Can we talk through our current setup and likely gaps without committing to anything?

Yes - and that is exactly what the first conversation is for. We will listen, ask sensible questions, and give you an honest view of whether and how we might be useful. There is no obligation, no follow-up pressure, and no proposal sent without your agreement to receive one. If we are not the right fit, we will say so clearly and still try to point you in the most useful direction.

What does a good first engagement typically look like?

For most organisations, the right first step is a Security Maturity Assessment - a structured review across People, Process, and Technology that produces a scored baseline, gap analysis, and prioritised roadmap. It gives both parties a shared, evidence-based picture before any services are recommended or scoped. For organisations with a more immediate or specific need - an imminent audit, a recent incident, or a targeted evaluation question - we sometimes start with a focused advisory session or scoping call instead.

Will we be pushed into a product or subscription straight away?

No. Our starting point is always understanding your situation first. We do not run quota-driven sales cycles, and we will not recommend a service until we have a clear picture of whether it is genuinely the right fit. If it is not, we will tell you that directly.

What if Koncise isn't the right fit for us?

We will say so honestly - and point you towards whoever would serve you better. Our operating principle, practised for 14 years, is to do right by customers even when it conflicts with short-term revenue. That includes the first conversation.

What's the fastest way to get a clear picture of where we stand?

The Security Maturity Assessment is the fastest structured route to an honest baseline. It covers People, Process, and Technology across 100 structured questions, maps against NCSC CAF, NIST, and CIS Controls, and produces a scored posture report, gap analysis, and prioritised roadmap - typically within a few weeks of starting.

How quickly does Koncise typically respond?

We aim to respond to all initial enquiries within one business day. There are no autoresponders and no ticketing systems for first contact. Every reply comes from a person who has read your message and can have a real conversation about what you are dealing with.

Back to Koncise Solutions

Terms & Conditions

Effective for all Quotes issued by Koncise Solutions Limited · Governed by the laws of England and Wales

These Terms & Conditions govern the provision of services by Koncise Solutions Limited (“Koncise”) to the customer named in the applicable Quote (together, this “Agreement”). This Agreement is self-contained. Where a Quote references third-party vendor products or services, the applicable vendor terms will be identified in the Quote and, where expressly incorporated, shall form part of the Agreement in respect of those vendor products only. No other external terms shall apply unless specifically attached to and expressly incorporated into the signed Quote.

1. Payment and Payment Terms

1.1 Customer agrees to pay the fees set out in the applicable Quote by bank transfer in accordance with the invoice instructions. Invoices will be issued on the date of signature and payment is due within the number of days stated on the quote.

1.2 Prices exclude VAT, which will be charged at the applicable rate. All pricing is fixed as set out in the Quote. No additional charges, overage fees or scope-based uplifts may be introduced without Customer’s prior written approval.

1.3 Customer may withhold amounts that are genuinely disputed in good faith, provided that: (a) undisputed amounts remain payable in accordance with the payment terms set out above; (b) the basis of any invoice query is raised in writing within 10 business days of receipt of that invoice; and (c) nothing in this clause shall prevent either party from bringing wider contractual claims in respect of matters that come to light after that period.

1.4 Amounts not paid when due shall accrue interest at 1.5% per month or the highest rate permitted by applicable law, whichever is lower, from the date due until the date paid.

2. Automatic Renewal

This Agreement will automatically renew at the end of the Subscription Period unless a written request to cancel is received by Koncise from Customer no less than 30 days prior to the renewal date. Cancellation requests must be submitted by email to renewals@koncisesolutions.com.

3. Service Warranty and Performance

3.1 Koncise shall provide the services with reasonable skill and care and in all material respects in accordance with the agreed scope set out in this Agreement.

3.2 If Customer notifies Koncise in writing of any material failure of the services to conform to the agreed scope, Koncise shall use reasonable endeavours to investigate and remedy such failure within 10 business days of notification, unless the nature of the issue reasonably requires a longer resolution period, in which case Koncise shall communicate a revised timeline promptly.

3.3 Koncise shall not be liable for any failure or delay caused by Customer’s systems, Customer delay or inaccuracy, or any third-party platform outage outside Koncise’s reasonable control, provided that Koncise remains responsible for managing the Koncise-delivered elements of the services with reasonable skill and care.

4. Confidentiality

4.1 Each party undertakes to keep confidential all confidential information received from the other party in connection with this Agreement and not to use such information for any purpose other than the performance or receipt of the services under this Agreement.

4.2 Each party shall disclose the other party’s confidential information only to those of its employees, contractors or advisers who have a genuine need to know it for the purposes of this Agreement, and shall ensure that such persons are subject to equivalent obligations of confidentiality.

4.3 Neither party shall disclose the other’s confidential information to any third party without the other’s prior written consent, save where required by law or regulation, or where the information is already in the public domain through no fault of the receiving party.

4.4 On termination or expiry of this Agreement, each party shall, on request, promptly return or securely delete all confidential information of the other party, and confirm in writing that it has done so.

4.5 The obligations in this clause shall survive termination or expiry of this Agreement for a period of two years.

5. Data Protection

5.1 To the extent that Koncise processes personal data on behalf of Customer in delivering the services, Customer is the data controller and Koncise is the data processor, each as defined under the UK GDPR and the Data Protection Act 2018. The categories of personal data and purposes of processing will be as set out in the applicable Quote or as otherwise agreed in writing between the parties.

5.2 Koncise shall: (a) process personal data only on Customer’s documented instructions and solely for the purpose of delivering the services; (b) implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage; (c) not transfer personal data outside the UK or EEA without Customer’s prior written consent; (d) assist Customer in meeting its obligations under applicable data protection law, including in relation to data subject rights requests; (e) notify Customer without undue delay on becoming aware of any personal data breach affecting Customer’s personal data; and (f) on termination or expiry of this Agreement, securely delete or return all Customer personal data as directed by Customer.

5.3 Koncise shall not engage any sub-processor in relation to Customer’s personal data without Customer’s prior written consent.

5.4 Each party shall comply with its respective obligations under applicable data protection legislation in connection with this Agreement.

6. Liability

6.1 Nothing in this Agreement excludes or limits either party’s liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; or (c) any other liability which cannot lawfully be excluded or limited.

6.2 Subject to clause 6.1, neither party shall be liable to the other for any indirect, consequential, special or punitive loss, or for any loss of profit, loss of revenue, loss of business, loss of goodwill, or loss of anticipated savings.

6.3 For the avoidance of doubt, clause 6.2 does not exclude or limit liability for: (a) breach of the confidentiality obligations in clause 4; (b) breach of the data protection obligations in clause 5; (c) unauthorised use or misuse of Customer’s name, brand or intellectual property; or (d) loss of data arising directly from any such breach or misuse.

6.4 Subject to clauses 6.1 and 6.5, Koncise’s total aggregate liability to Customer arising out of or in connection with this Agreement, whether in contract, tort (including negligence), misrepresentation or otherwise, shall not exceed 100% of the total fees paid or payable by Customer under this Agreement.

6.5 Koncise’s aggregate liability arising from breach of clause 4 (Confidentiality) or clause 5 (Data Protection) shall not exceed 150% of the total fees paid or payable by Customer under this Agreement.

6.6 Where the Agreement includes third-party vendor products or services, Koncise’s liability in respect of those products or services is limited to using reasonable endeavours to enforce any warranty or remedy available under the applicable vendor terms. Koncise accepts no liability for failures, defects or losses arising from vendor products beyond this.

7. Termination

7.1 Either party may terminate this Agreement on written notice if the other party: (a) commits a material breach of this Agreement and (where the breach is capable of remedy) fails to remedy it within 14 days of receiving written notice requiring it to do so; (b) becomes insolvent, enters administration, receivership, liquidation or makes any arrangement with its creditors; or (c) persistently fails to meet its material obligations under this Agreement in a manner that cannot reasonably be remedied.

7.2 On termination by Customer under clause 7.1, Koncise shall refund a pro-rata proportion of any prepaid fees relating to Koncise-delivered services not yet provided as at the effective date of termination. Fees relating to third-party vendor products are subject to the refund terms of the applicable vendor.

7.3 Termination shall not affect any accrued rights or liabilities of either party as at the date of termination, nor shall it affect any provisions of this Agreement that are expressed or implied to survive termination.

8. Privacy Policy

Koncise’s Privacy Policy is available at our Privacy Policy and describes Koncise’s general data handling practices. To the extent of any conflict between the Privacy Policy and the express terms of this Agreement (including clause 5), the express terms of this Agreement shall prevail.

9. Use of Customer Name and Brand

Koncise shall not use Customer’s name, logo, or refer to Customer publicly as a customer or user of the services without Customer’s prior written consent. This clause shall survive termination of this Agreement.

10. Assignment

Neither party may assign this Agreement or any of its rights or obligations under it without the other party’s prior written consent, save that either party may assign without consent in connection with an intra-group reorganisation, affiliate transfer, or a sale of the whole or substantially the whole of its business to which this Agreement relates, provided that the assigning party gives prompt written notice of any such assignment.

11. Disputes

Any dispute arising out of or in connection with this Agreement shall be referred first to senior representatives of both parties for good faith resolution. If not resolved within 20 business days, either party may pursue its legal remedies. Nothing in this clause prevents either party from seeking urgent interim relief from a court of competent jurisdiction.

12. Governing Law

This Agreement and all matters arising out of or in connection with it (including non-contractual disputes) are governed by the laws of England and Wales. The courts of England and Wales shall have exclusive jurisdiction to settle any disputes arising out of or in connection with this Agreement.

Back to Koncise Solutions

Privacy Policy

Last updated: March 2026 · Koncise Solutions Limited · Company No. 07789203

1. Introduction

Koncise Solutions Limited (“Koncise”, “we”, “us”, “our”) is committed to protecting the privacy and security of your personal data. We are a cybersecurity consultancy and managed services provider, and we take the handling of information - yours and your organisation’s - as seriously as we expect our customers to.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights in relation to it. It applies to data collected through our website, in the course of providing our services, and through any other interaction you have with us.

This policy is effective from March 2026 and supersedes any previous privacy policies issued by Koncise Solutions Limited.

Registered Address Koncise Solutions Limited
Aston House, Cornwall Avenue
London, N3 1LF
Company No. 07789203 | VAT No. 139335112

Data Protection Contact Email: info@koncisesolutions.com
Phone: 0207 078 0789

2. About Koncise Solutions

Koncise Solutions Limited is a UK-based cybersecurity specialist working with 170+ organisations across the UK, protecting over 100,000 users globally. Headquartered in Borehamwood with offices in Ipswich, we serve clients across the UK with a consultative, people-first approach to security.

Our services span the full security lifecycle - from managed phishing simulations and human risk training, to 24/7 MDR, endpoint protection, identity and access management, data security, and compliance frameworks including Cyber Essentials, ISO 27001, and NCSC CAF.

For the purposes of UK data protection law, Koncise Solutions Limited is the data controller in respect of personal data collected in connection with our general business operations, website, and marketing activities.

Where we process personal data on behalf of a client as part of delivering contracted services (for example, employee data provided to us for the purpose of running phishing simulations), we act as a data processor, and the client remains the data controller.

3. What Personal Data We Collect

Customer and prospect contacts

In the course of our business, we collect and process the following categories of personal data:

Name, job title, and company name
Business email address and telephone number
Business postal address
Records of communications and interactions with us
Contract dates and service details
Bank details, where payment by direct debit is agreed
Records of technologies in use, where relevant to a specific engagement

Managed phishing simulation services

Where we deliver managed phishing simulations on behalf of a client, we process the following personal data belonging to the client’s employees, solely for the purpose of delivering the service:

Employee names
Company email addresses

This data is provided by the client and processed strictly in accordance with their instructions and the terms of our service agreement. It is not used for any other purpose.

Website visitors

When you visit our website, we may collect standard technical data including IP address, browser type, and pages visited, via cookies and analytics tools. Please refer to our Cookies Policy for further detail.

4. Legal Basis for Processing

We process personal data on the following legal bases under UK GDPR:

Contract performance (Article 6(1)(b)) - where processing is necessary to deliver services you or your organisation have engaged us to provide, or to take steps prior to entering into a contract.
Legitimate interests (Article 6(1)(f)) - where we contact prospective customers who may have a genuine interest in our services, or where we process data to protect and improve our business, provided this does not override your rights and interests.
Legal obligation (Article 6(1)(c)) - where we are required to process data to comply with applicable law.
Consent (Article 6(1)(a)) - where you have given us specific consent, for example to receive marketing communications.

5. How We Use Your Personal Data

We use personal data for the following purposes:

Delivering and managing the services set out in our agreements with you
Communicating with you about your account, services, or queries
Sending relevant updates, event invitations, and service information to existing customers and prospects (where permitted)
Improving our services and understanding how our customers use them
Meeting our legal and regulatory obligations
Protecting our legitimate business interests, including fraud prevention and contract enforcement

6. Who We Share Your Data With

We do not sell, rent, or trade personal data. We may share data in the following limited circumstances:

With trusted suppliers and technology partners who support the delivery of our services, under appropriate contractual obligations
With professional advisers (legal, financial, insurance) where necessary
With regulatory authorities or law enforcement where required by law

Any third parties with whom we share data are required to handle it securely and only for the purposes for which it was shared.

We do not transfer personal data outside the UK or EEA. If this were ever to change, we would notify affected individuals and ensure appropriate safeguards are in place.

7. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law. Our standard retention periods are:

Customer personal data: for the duration of the customer relationship plus 18 months
Prospect and marketing contact data: reviewed annually; retained only where there remains a legitimate interest in maintaining contact
Employee data: for the duration of employment plus 3 years
Contract documents: 10 years
Financial and accounting records: 6 years
Phishing simulation campaign data (employee names and email addresses): deleted securely within 30 days of campaign completion, unless otherwise agreed in writing with the client

When data reaches the end of its retention period, it is securely deleted or destroyed in accordance with our Data Deletion and Destruction Policy.

8. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

The right to be informed - to know how your data is being used (this policy fulfils that obligation)
The right of access - to request a copy of the data we hold about you
The right to rectification - to request correction of inaccurate or incomplete data
The right to erasure - to request deletion of your data where there is no compelling reason for continued processing
The right to restrict processing - to request that we limit how we use your data in certain circumstances
The right to data portability - to receive your data in a structured, machine-readable format
The right to object - to object to processing based on legitimate interests or for direct marketing

To exercise any of these rights, please contact us at info@koncisesolutions.com. We will respond within 30 days of receipt of a valid request. There is no charge for making a request, unless requests are manifestly unfounded or excessive.

9. Complaints

If you have concerns about how we handle your personal data, please contact us in the first instance at info@koncisesolutions.com. We take all complaints seriously and will respond promptly.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO):

Website: ico.org.uk/concerns
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or disclosure. All staff with access to personal data are subject to confidentiality obligations and receive appropriate training.

In the event of a personal data breach that is likely to result in a risk to individuals’ rights and freedoms, we will notify the ICO within 72 hours and, where required, inform affected individuals without undue delay.

11. Cookies

Our website uses cookies to analyse traffic and improve user experience. We use Google Analytics for this purpose, which may process data on servers outside the UK. You can manage cookie preferences through your browser settings. Please see our separate Cookies Policy for full details.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The current version will always be available on our website at koncisesolutions.com. Where changes are material, we will notify affected customers directly.

Cookie Policy

Last updated: April 2026 · Koncise Solutions Limited · Company No. 07789203

Back to Koncise Solutions

Work With Us

Koncise Solutions Limited · Borehamwood · Ipswich · Hybrid

We’re a growing cybersecurity consultancy helping businesses across the UK understand and improve their security posture. We’re not actively recruiting at the moment, but we’re always glad to hear from people who are serious about their craft - so the roles below stay here for context, and the door stays open.

Roles

Chief Hacking Officer

Offensive Security · Borehamwood / Ipswich / Hybrid · Full-Time

Closed

The Role

Security testing is becoming a core part of what Koncise delivers, and we’re looking for someone to lead that practice as it scales. As Chief Hacking Officer, you will take ownership of our penetration testing capability - shaping the methodology, building the team around you, and delivering high-quality offensive engagements for a client base that already trusts us with their detection, identity and email security.

This is a rare opportunity to build something properly: your own practice, your own approach, an existing client base to deliver into, and a leadership team that understands security and gives you the room to do the work well.

What You’ll Do

›Lead and scale Koncise’s penetration testing practice - methodology, tooling, and team
›Lead and deliver offensive security engagements: infrastructure, web application, social engineering, red team
›Translate technical findings into clear, actionable reports that clients and their boards can act on
›Work closely with our consulting team to integrate offensive insights into client security roadmaps
›Contribute to thought leadership, client events, and the Koncise brand in the security community

What We’re Looking For

›Proven hands-on experience in penetration testing or red team operations
›Strong technical skills across network, web application, and Active Directory attack paths
›Experience writing professional, client-ready penetration testing reports
›The credibility and communication skills to work directly with clients at all levels
›Relevant certifications (OSCP, CREST CRT, or equivalent) are a strong advantage

What We Offer

›Competitive salary commensurate with experience
›The autonomy to build the practice your way, with full leadership support
›A platform and an existing client base to deliver into from day one
›Hybrid working, teams based in Borehamwood and Ipswich, and a culture that takes security seriously

Account Manager

Client Relationships · Borehamwood / Ipswich / Hybrid · Full-Time

Closed

The Role

Account Management at Koncise looks different to most. We’ve held a 99% retention rate for fourteen years by doing right by customers even when it costs us short-term revenue - so this is a role about understanding a client’s security position properly and helping them make good decisions, not about working a pipeline.

You’d own a portfolio of existing relationships, get genuinely close to what those organisations are trying to achieve, and bring in the right specialists at the right time.

What You’ll Do

›Own and grow long-term relationships with an existing client base of IT and security leaders
›Understand each client’s security maturity well enough to know what they actually need next
›Translate technical findings into commercial language that lands with boards and finance teams
›Work alongside our technical teams to scope engagements and keep delivery on track
›Tell a client when they don’t need something. It’s how we’ve kept them for a decade or more

What We’re Looking For

›Experience managing B2B client relationships, ideally in technology, IT services or cybersecurity
›Enough technical curiosity to hold your own with an IT Director - we’ll teach you the rest
›Genuinely consultative instincts. If you thrive on high-pressure closing, this isn’t the right fit
›Clear written communication - much of this role is making complicated things easy to understand

What We Offer

›Competitive salary commensurate with experience
›An established client base with unusually high retention, rather than a cold list
›Technical specialists alongside you, so you’re never selling something you can’t explain
›Hybrid working, teams based in Borehamwood and Ipswich, and no churn-and-burn sales culture

Interested anyway?

We’re not recruiting for either role right now, but we’re always open to hearing from great people. If you think you’d be a good fit for Koncise - whether that’s one of the roles above or something we haven’t thought of - send us your details through our contact page.

Applications are read personally by our leadership team. There’s no ATS and no automated screening, and we’ll keep good applications on file for when something does open up.

Send Us Your Details →

Free Tool

Free Email Health Check

Enter your work email and we'll instantly score your domain's protection against phishing, spoofing and impersonation. Free. No obligation.

Check Your Domain

How protected is your domain?

Enter your work email below. We'll analyse your domain across impersonation protection, email privacy and branding - and give you an instant score out of 100.

Your Domain Score

Your email is used solely to identify your domain. We won't add you to a mailing list without your consent.

Score below 80?We'll walk you through exactly what needs fixing.

Talk to Koncise

Understanding Your Score

What does your score mean?

Every domain gets a score out of 100 based on its email authentication configuration. The score reflects how well your domain is protected against three categories of threat:

Impersonation - can criminals send emails pretending to be you?
Privacy - can emails sent from your domain be intercepted?
Branding - do recipients see your logo and verified identity?

80-100

Well Protected

Your domain is well-configured. Email impersonation risk is low, your communications are private, and recipients see your branding. Keep it maintained.

40-79

Action Needed

Some protections are in place, but gaps remain. Criminals could still exploit your domain. Closing these gaps improves deliverability and reduces risk.

0-39

High Risk

Little to no protection. Your domain can be used by cybercriminals to send fraudulent emails in your name - putting your brand and customers at serious risk.

Why This Matters

Email fraud is the most common entry point for cyberattacks.

01

Impersonation

Without DMARC enforcement, anyone can send emails that appear to come from your domain. Customers, suppliers and staff can all be targeted - in your name.

02

Email Interception

Emails without MTA-STS and TLS-RPT policies can be intercepted in transit. Sensitive communications - contracts, credentials, invoices - are readable by attackers.

03

Trust and Deliverability

Domains without proper authentication score lower with email providers. Your legitimate emails are more likely to land in spam - and less likely to be trusted.

What Happens Next

We don't just show you the score - we help you fix it.

Once you've run your check, Koncise can walk you through exactly what the results mean for your business and what needs to happen next - whether that's a quick configuration fix or a fuller DMARC remediation programme.

Plain-English explanation of your score and what's driving it
Priority actions based on your specific gaps
Options for full DMARC management if needed

Talk to Koncise About Your Score

Powered by Sendmarc

About this tool

This health check is powered by Sendmarc - a leading DMARC management platform used by thousands of organisations worldwide. The scoring algorithm analyses your domain's SPF, DKIM, DMARC, MTA-STS and BIMI configuration in real time.

Koncise is a Sendmarc partner. Any leads generated through this tool are shared with Koncise in accordance with our Privacy Policy.

Domain Security FAQ

Common questions about email authentication and domain security

What is DMARC and why does my business need it?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol that tells receiving mail servers what to do when an email claims to come from your domain but fails authentication checks. A DMARC policy protects your domain from being used in phishing and impersonation attacks. Without it, cybercriminals can send emails that appear to come from your company - targeting your customers, suppliers and staff. DMARC also generates reporting data that tells you exactly who is sending email on your behalf, giving you visibility into your entire email ecosystem.

What is the difference between p=none, p=quarantine and p=reject?

The DMARC policy tag p= controls how receiving mail servers handle emails that fail authentication. p=none monitors email traffic but takes no action - your domain can still be spoofed freely. p=quarantine routes failing emails to spam folders, reducing but not eliminating risk. p=reject is full enforcement - unauthenticated emails claiming to be from your domain are blocked entirely before reaching the inbox. Most cybersecurity advisors recommend progressing to p=reject for maximum protection, but the transition requires careful analysis of all legitimate sending sources to avoid blocking genuine emails.

Can someone send emails pretending to be from my company?

Yes - if your domain has no DMARC policy, or only p=none, email impersonation (also called domain spoofing) is technically straightforward for attackers. Anyone can forge the "From:" address in an email to display your company's domain. This is one of the most common methods used in business email compromise (BEC) attacks, supplier fraud, and phishing campaigns. Victims receive emails that look entirely legitimate - correct domain, correct branding - and are instructed to transfer funds, share credentials, or click malicious links. Your domain health score directly reflects your exposure to this risk.

What is SPF and how does it work?

SPF (Sender Policy Framework) is a DNS record that lists the mail servers authorised to send email on behalf of your domain. When a receiving server gets an email claiming to be from your domain, it checks your SPF record. If the sending server isn't listed, the email fails SPF. However, SPF alone does not prevent impersonation - it only checks the "envelope from" address, not the visible "From:" header. DMARC is needed to act on SPF failures and apply a policy. A common SPF misconfiguration is having too many DNS lookups (over 10), which causes lookup failures and can quietly break email authentication.

What is DKIM and why does it matter?

DKIM (DomainKeys Identified Mail) adds a cryptographic digital signature to outgoing emails, verified by recipients against a public key published in your DNS. It proves two things: that the email genuinely originated from your organisation, and that it hasn't been tampered with in transit. Like SPF, DKIM alone doesn't stop impersonation - it needs to work alongside DMARC, which enforces action when DKIM signatures are missing or invalid. A key operational issue is rotating DKIM keys: old or shared keys across multiple services can weaken authentication without the domain owner realising.

What is BIMI and how does it benefit my business?

BIMI (Brand Indicators for Message Identification) is an email standard that displays your verified brand logo next to your emails in supporting inboxes - including Gmail, Yahoo and Apple Mail. Achieving BIMI requires a DMARC policy at p=quarantine or p=reject, a correctly formatted SVG logo, and in most major email clients a Verified Mark Certificate (VMC) from a trusted Certificate Authority. The business benefits are significant: instant brand recognition in the inbox, a visible signal that the email is genuine, and measurable improvements in open rates. BIMI is increasingly used by security-conscious organisations to differentiate their communications from spoofed emails.

How does my domain's email authentication affect deliverability?

Email providers including Google, Microsoft and Yahoo use domain authentication signals - SPF, DKIM and DMARC - to assess the trustworthiness of incoming email. In 2024, Google and Yahoo made DMARC a mandatory requirement for bulk senders. Domains with missing or misconfigured authentication are significantly more likely to be routed to spam, rate-limited, or blocked entirely by receiving mail servers. A properly authenticated domain with a strong DMARC policy improves inbox placement because receiving servers have strong evidence the email is legitimate. Poor deliverability isn't just a marketing problem - it affects transactional emails, invoices and operational communications too.

What is MTA-STS and why is it included in my domain score?

MTA-STS (Mail Transfer Agent Strict Transport Security) is a security mechanism that forces mail servers communicating with your domain to use encrypted TLS connections. Without it, email traffic between mail servers can be subject to downgrade attacks - where an attacker forces a connection to fall back to unencrypted transmission, making emails readable in transit. MTA-STS works alongside TLS-RPT (Transport Layer Security Reporting), which sends you diagnostic reports when TLS connections to your domain fail. Together they protect the privacy and integrity of emails in transit, not just at the point of sending or receiving.

What is the difference between SPF, DKIM and DMARC?

Think of them as three layers of email authentication that work together. SPF lists the servers permitted to send email from your domain. DKIM adds a cryptographic signature to prove the email is genuine and unaltered. DMARC is the enforcement layer - it ties SPF and DKIM together, tells receiving servers what to do when emails fail those checks (deliver, quarantine or reject), and sends you reports on authentication activity across your domain. Having SPF and DKIM without DMARC still leaves your domain vulnerable because there is no mechanism to act on authentication failures.

How do I improve my domain security score?

Improving your score follows a structured sequence: publish a valid SPF record listing all authorised mail senders; enable DKIM signing on every outbound mail stream (including third-party tools like your CRM, marketing platform and ticketing system); deploy DMARC starting at p=none to monitor, then progress through p=quarantine to p=reject once all legitimate senders are identified and authorised; implement MTA-STS to enforce encrypted email transit; and optionally add a BIMI record to display your logo in supporting inboxes. The most common mistake is attempting to jump straight to p=reject without first analysing DMARC reports - this risks blocking legitimate email. Koncise manages this entire process as part of our DMARC managed service.

What is a DMARC managed service?

A DMARC managed service handles the full lifecycle of email authentication on your behalf. This includes initial deployment at p=none, ongoing analysis of DMARC aggregate and forensic reports, identification and authorisation of every legitimate sending source, and safe progression to full enforcement at p=reject. Managing DMARC without expert help requires interpreting XML report files, understanding the email ecosystem of your entire organisation, and carefully coordinating changes with third-party sending services. A managed service removes this complexity while ensuring nothing legitimate is disrupted during the transition to full enforcement.

How long does it take to reach full DMARC enforcement?

DNS changes propagate globally within 24-48 hours, so technical changes take effect quickly. However, safely moving from p=none to p=reject requires collecting and analysing DMARC aggregate reports over several weeks to identify every source sending email from your domain - including third-party tools your team may have connected without IT's knowledge. Rushing to enforcement risks blocking legitimate emails from services like Salesforce, Mailchimp, DocuSign or your finance system. For most organisations, Koncise achieves full p=reject enforcement within 60-90 days, depending on the complexity of the email ecosystem. Organisations with simpler setups can reach enforcement faster.

Free Assessment

See your complete email security risk - free

Your domain score shows your technical exposure. A free managed phishing simulation reveals your human risk. Together, they give your leadership team a clear, evidence-based picture of where your business is vulnerable - at no cost and with no obligation.

Claim Your Free Assessment Learn About Free Phishing

Free Service

Understand Human Risk With a Free Managed Phishing Campaign

Gain insight into risk and your users' security behaviours - with full reporting, behavioural analysis, and no strings attached.

Book Your Free Campaign

Josh CTO, Koncise

"Phishing is the most effective attack vector for cybercriminals, yet too many businesses rely on off-the-shelf phishing templates that don't reflect real-world threats. At Koncise, we take a spear phishing approach, crafting highly targeted simulations that mimic the tactics we see attackers using in the wild. This free managed phishing campaign isn't just about seeing who clicks - it's about understanding user behaviours, identifying real risks, and providing actionable insights that you can articulate back to your business. And there's no catch - this is simply a chance to experience working with us first-hand."

Human Risk Landscape

Why run a free managed phishing campaign?

52.2%

Slipping through the net

In 2024, there was a 52.2% increase in the number of attacks that got through Secure Email Gateway (SEG) detection and a 50.9% increase in attacks bypassing Microsoft's native defences.

61%

It started with a phish

61% of the root cause of ransomware attacks in 2024 was introduced through 'human-activated risk'. Compromised credentials, malicious emails, phishing, downloads and more.

<60s

Less than 60 seconds

The median time to click a malicious link after opening the email is 21 seconds - then only 28 more to enter credentials. The median time to fall for a phishing email is less than 60 seconds.

Visual Risk

See how phishing spreads through your organisation

Unaffected Compromised Reported Remediated

Managed Phishing Overview

What's included in your free managed phishing campaign?

01

Spear Phish Campaign Templates

Campaigns built on real-world phishing we see in the wild - not generic off-the-shelf templates. Every simulation is tailored to mimic the tactics attackers are actually using against businesses like yours.

02

Full Exec-Ready Reporting

Includes Click-Rate %, Credential Harvest %, Industry Benchmarking, Device Type Breakdown, User Behaviour Analysis, and Consultative Recommendations - ready to present straight to your board.

03

Fully Managed Delivery

No internal resource required. We handle scoping, template selection, whitelisting, scheduling, tracking, and reporting end to end. Designed to scale without adding to your workload.

"

I have been working with Koncise for the past 2 years understanding human risk through their phishing simulation service and I can say the service has been thoroughly professional and second to none - which has culminated in a tangible reduction in insider threat risk. I also congratulate Koncise for their passion and work elevating the importance of cyber security in our local and national business communities.

Kevin W.

Head of Cyber and IT Security

Delivered as a Fully Managed Service

How it works

01

Scoping call

We discuss campaign ideas together - tailoring the simulation to reflect real threats relevant to your sector and organisation.

02

User details

Send us a CSV with your user details. That's all we need to get started on configuration and delivery.

03

Whitelisting and testing

We handle all whitelisting and test delivery to ensure accurate results - no false positives, no missed clicks.

04

Campaign schedule

We agree the campaign timing together and handle everything from here - delivery, tracking, and data collection.

05

Results presentation

We present the full results together - with actionable recommendations you can take straight back to your business and board.

Our Mission

What to expect on the call

Want to learn more about our free managed phishing campaign and how it can help uncover human risk in your organisation? Book a session with our CCO, Max Harper, to walk through the details, what's included, and how we tailor the simulation to mimic real-world attacks.

We'll cover:

How the free campaign works - a spear phishing simulation tailored to your business
What you'll get - full reporting, behavioural insights, and actionable recommendations
Next steps - how to use the results to enhance your security awareness strategy

And if he's not too busy phishing our customers, we'll loop in our CTO, Josh, to share his expertise too!

Book Your Free Campaign

No catch

Why are we offering this for free?

This is simply a chance to experience working with us first-hand. We believe that once you see the quality of our reporting and the clarity of our insights, the value of having Koncise as a cybersecurity partner speaks for itself.

No sales pressure. No obligation. Just real data about your real risk.

Recently Shared

Keep It Koncise Blog

Straight-talking cybersecurity insight on phishing, human risk, and the threats that actually matter.

View the Blog

You May Need to Know

Frequently Asked Questions

Can't we just run phishing simulations ourselves?

You could - but the difference is in the delivery. We remove all the guesswork, vet every click to exclude false positives like scanners and bots, and present the results clearly. No manual data cleaning, no missed insights - just real human behaviour, accurately measured.

We already have a phishing platform - why use this service?

Having a platform is one thing. Using it effectively is another. You'd still need to scope clients, pick relevant templates, manage whitelisting, and build reports. With Koncise, you get expert-curated campaigns built around what's actually bypassing email defences - all fully managed, and branded to you.

How much time does this take to manage?

Very little. You simply pick a campaign, fill out a form, and we handle everything else - including whitelisting guidance, delivery, tracking, and reporting. It's designed to scale without adding to your workload.

Will users get annoyed by these tests?

Not at all. Our simulations are designed to mimic real threats without disruption. If a user clicks, they're taken to a branded training page - no lectures, no public call-outs. Just clear, constructive feedback in the moment that matters most.

What if we want a custom phishing template?

We include a wide range of relevant, real-world templates as standard. However, if you want something bespoke - such as a scenario tailored to a specific brand, process, or department - we can build a custom Spear Phish Pack for a one-off fee of £100.

Will the reporting be branded to us?

Yes - every touchpoint is white-labelled, including reports and training pages. Your logo, your presence, our delivery.

Free Assessment

See your complete email security risk - free

A free managed phishing simulation reveals your human risk. Combine it with a free email health check and you'll give your leadership team a clear, evidence-based picture of where your business is exposed - at no cost and with no obligation.

Book Your Free Campaign Check Your Domain Score

← Security Validation · Detection Validation

Test Your MDR

Already using an MDR provider? Find out whether your security controls, detection visibility, and response capability would genuinely stand up under real-world pressure.

Book Your MDR Review See What’s Included

The Challenge

MDR only works if it sees the right things

Many organisations invest in MDR expecting 24/7 protection, but few ever properly test whether their existing provider can detect meaningful threats across identity, cloud, endpoint, and user activity.

If your environment contains stale accounts, over-privileged users, weak MFA coverage, exposed remote access, or poor visibility into Microsoft 365, your MDR may be missing some of the risks that matter most - and you could be paying for monitoring without knowing whether it would truly help when it counts.

Questions worth asking

Is your MDR actually seeing the right threats?
Would suspicious identity activity get picked up?
Are stale accounts and privilege gaps creating blind spots?
Can your current setup detect realistic attack behaviour?
If an attacker got in, how quickly would somebody know?

What’s Included

A practical way to pressure-test your security posture

Test Your MDR combines two complementary services into one focused engagement:

01

Exposure & Detection Review

We assess the areas attackers commonly exploit and many incumbent providers fail to properly surface. A rigorous, evidence-led review of your security posture, monitoring coverage, and the visibility gaps most likely to matter when it counts.

Identity & Access Microsoft 365 MFA Coverage Privilege Review Monitoring Gaps

02

Offensive Validation

We validate your real-world resilience through controlled testing designed to identify exploitable weaknesses and determine whether your monitoring and response capability would actually detect, escalate, and act on meaningful attacker behaviour.

Penetration Testing Red Team Techniques Detection Validation Response Assessment

Assessment Coverage

What we look at

Our exposure and detection review covers the areas most commonly missed by incumbent MDR providers:

Privileged Access & Identity Exposure

Review of admin accounts, service accounts, and identity paths that represent elevated risk if compromised.

Stale Accounts & Password Hygiene

Identification of dormant, unused, or poorly managed accounts creating unnecessary attack surface.

MFA Coverage & Conditional Access

Analysis of authentication gaps, MFA bypass risks, and inconsistent conditional access policies.

Suspicious Authentication Activity

Review of sign-in behaviour, anomalous access patterns, and impossible travel indicators.

Microsoft 365 Visibility & Alerting

Assessment of M365 monitoring coverage, alert configuration, and logging gaps across your tenant.

Remote Access & RDP Exposure

Identification of externally exposed services, remote access risks, and attack surface reduction opportunities.

Monitoring Blind Spots

Mapping of coverage gaps across key attack paths - particularly those your current MDR may not be tuned to detect.

Controlled Offensive Testing

Practical exploitation attempts to validate whether weaknesses can be exploited and whether your monitoring would respond appropriately.

Deliverables

What you’ll come away with

Every Test Your MDR engagement delivers clear, actionable findings - not a generic report.

A clearer view of your current risk exposure
Evidence of whether your monitoring is focused on the right areas
Insight into identity and Microsoft 365 weaknesses
Visibility into privilege, authentication, and access risks
Findings from controlled offensive testing
Practical recommendations to improve resilience
A clearer view of whether your current MDR is delivering genuine value

Book Your MDR Review

Who It’s For

Built for organisations that already have MDR - but want proof it’s working

This assessment is well-suited for organisations that:

Already use an MDR provider

Are approaching renewal and want an independent view

Suspect they have gaps in visibility or response capability

Want to understand whether identity threats are being properly monitored

Need evidence before making a security investment decision

Want to benchmark their current service before considering a change

Common Findings

What this often reveals

These are the most frequent gaps we identify during a Test Your MDR engagement:

01

Monitoring focused too heavily on endpoint alone - with limited visibility across identity and cloud activity

02

Limited visibility into identity-based threats, including compromised credentials and lateral movement

03

Stale or over-privileged accounts creating unnecessary risk that isn’t actively monitored

04

Inconsistent MFA adoption, with conditional access gaps leaving authentication exposed

05

Weak controls around remote access and externally exposed services

06

Significant gaps in Microsoft 365 monitoring - detections that exist on paper but aren’t tuned to the real environment

No Agenda

Useful whether you stay with your current provider or not

The purpose of Test Your MDR is straightforward: to give you a clearer picture of how well your current security operation is genuinely performing.

In some cases, the outcome is reassurance. In others, it highlights important gaps in visibility, control, and response that need addressing - gaps that are far better found by us than discovered by an attacker.

Either way, you leave with practical findings, evidence-based recommendations, and a stronger understanding of your current position - whatever you choose to do next.

Common Questions

Frequently Asked Questions

What is a Test Your MDR assessment?

A Test Your MDR assessment is an independent validation of your existing managed detection and response (MDR) service. It combines a focused security exposure review with controlled penetration testing to identify blind spots, assess detection visibility, and determine whether your current monitoring and response capability would hold up under real-world attack conditions.

How do I know if my MDR provider is actually working?

The most reliable way to find out is to test it. Most organisations rely on their provider's reporting rather than independent validation. A Test Your MDR engagement uses real offensive techniques alongside a structured exposure review to assess whether your existing service is detecting the threats that matter - not just generating activity reports.

What does the exposure review look at?

The exposure review covers identity and privileged access, stale accounts, MFA coverage and conditional access gaps, suspicious authentication activity, Microsoft 365 monitoring visibility, remote access exposure, and monitoring blind spots across key attack paths. These are the areas most commonly missed by incumbent MDR providers and most likely to create genuine risk.

What is the difference between MDR and a penetration test?

MDR (managed detection and response) is an ongoing monitoring and response service designed to detect and contain threats in real time. A penetration test is a point-in-time assessment that attempts to exploit vulnerabilities to identify weaknesses. Test Your MDR combines both: a monitoring review to assess what your MDR can see, and controlled offensive testing to validate whether those controls hold up in practice.

Is this only useful if we're thinking of switching MDR provider?

No. Many organisations use Test Your MDR to gain independent confidence in their existing service ahead of renewal, or simply to understand their current risk exposure more clearly. In some cases the findings provide reassurance. In others, they highlight important gaps. The goal is clarity and evidence - not to push a provider change.

What identity threats should our MDR be detecting?

Effective MDR should detect suspicious sign-in patterns, impossible travel, anomalous access, privilege escalation, lateral movement, compromised credential use, and unusual Microsoft 365 activity - including inbox rule manipulation and OAuth application consent abuse. If your provider is not surfacing these, you likely have significant blind spots in your identity security posture.

Do we need to pause or change our current MDR service during the assessment?

No. Test Your MDR is designed to run alongside your existing provider without disrupting live operations. The engagement is conducted in a controlled, agreed manner and you retain full control over how much visibility your incumbent provider has during the process.

How long does a Test Your MDR engagement take?

Timelines vary depending on the size and complexity of your environment, but most engagements are completed within two to four weeks. We agree the exact scope during an initial consultation before any work begins, so you have a clear picture of what's involved before committing.

What happens after the assessment?

You receive a detailed findings report covering identified exposures, monitoring gaps, and outcomes from controlled offensive testing - alongside prioritised remediation recommendations. We present the findings in a dedicated workshop and can support remediation planning, security improvements, or further engagement as a natural next step.

Who is Test Your MDR designed for?

Test Your MDR is designed for IT Directors, Heads of IT, Security Managers, and CISOs in organisations that already use an MDR provider. It is particularly relevant for those approaching contract renewal, those who suspect gaps in visibility or response, or those who need independent evidence before making a security investment decision.

Take the First Step

Want to see how your current MDR stands up?

Book a Test Your MDR consultation and we’ll walk you through the scope, likely focus areas, and how the engagement can help you validate your existing setup - before renewal, before change, or simply to build confidence in what you have.

Book a Consultation See All Security Validation

Detection validation is one of three ways we test. There is also penetration testing and adversary simulation.

Free Assessment

Your people are already using AI. Do you know what they're sharing?

A free, managed AI Risk Assessment gives you instant visibility into how AI is really being used across your organisation - from sanctioned tools to shadow AI - and exactly what sensitive data is leaving your control.

The AI Risk Reality

AI adoption is outpacing security awareness.

Most organisations have no idea how many AI tools their people are using, what data is being entered, or where that data ends up. The assessment changes that - in days, not months.

78%

Using personal AI tools at work

78% of employees access AI at work via personal tools - outside of any IT visibility, policy, or control. What's being typed into those tools is rarely tracked.

Source: Microsoft

54%

No IT oversight whatsoever

More than half of employees are using AI tools without IT oversight or company approval. That's sensitive business data going somewhere nobody has audited.

Source: BCG

96%

Executives expect AI breach risk

96% of executives expect an AI-related security breach within three years. The assessment tells you where your organisation stands right now - before an incident forces the question.

Source: IBM

How It Works

Visibility in days. No disruption. No obligation.

The assessment runs quietly in the background - lightweight, privacy-first, and non-intrusive. Here's what happens from deployment to debrief.

01

Deploy in days

A lightweight browser-based deployment means no complex onboarding, no infrastructure changes, and no disruption to your team. You're up and running fast.

02

Track every AI interaction

Across sanctioned platforms, embedded SaaS features, and shadow tools your IT team didn't even know about. Nothing is missed - including AI features baked into tools you already use.

03

Capture rich context

Prompts, files, frequency, data sensitivity, and user patterns - giving you a forensic picture of how AI is actually being used, not just what tools are installed.

04

Profile risk automatically

Risk is mapped by user, data type, and behaviour pattern - so you can see not just what's happening, but who is driving the highest-risk activity and what data is most exposed.

05

Spot critical incidents

Credentials pasted into AI tools. Source code shared externally. Confidential contracts uploaded. The assessment surfaces the kind of incidents that most organisations only discover after the damage is done.

06

Get your report and walkthrough

You receive a clear, leadership-ready report from the Koncise team - not just a dashboard login. We walk you through the findings and recommend your next steps.

What You Get

A report your leadership team can actually act on.

The assessment produces a clear breakdown across six areas - giving your IT, security, and compliance leads the evidence they need to make informed decisions about AI governance.

AI apps in use

A complete inventory of every AI tool in active use - sanctioned and unsanctioned - across your estate. Most organisations are surprised by the volume.

Active AI users and adoption rate

How many of your people are actively using AI tools, across which departments, and at what frequency - giving you an accurate baseline for policy and training decisions.

Sensitive data types exposed

Every category of sensitive data that has been entered into AI tools - HR records, legal details, financial data, infrastructure documentation, and more - mapped to the specific apps receiving it.

High-risk incidents identified

The critical events that demand immediate attention - credentials shared with AI tools, confidential strategy documents uploaded, source code exposed to external platforms.

Data processing locations

Where your data is being processed and stored by AI tools - including tools that process data in jurisdictions that may not align with your compliance obligations under UK GDPR or client contracts.

Prioritised recommendations

Not a list of problems - a sequenced action plan. Immediate steps to close critical gaps, and longer-term recommendations for sustainable AI governance without blocking productivity.

Schedule Yours

Find out what's really happening with AI in your organisation.

No cost. No commitment. Just a clear picture of your AI risk - and a conversation about what to do next.

Book Your Free AI Risk Assessment

AI Risk Questions

AI Risk Assessment FAQs

What is a free AI Risk Assessment?

A free AI Risk Assessment is a managed, time-limited exercise that gives your organisation complete visibility into how AI tools are being used by your employees - including tools your IT team hasn't approved. Over a defined assessment period, every AI interaction is tracked across sanctioned platforms, embedded SaaS features, and shadow tools. The output is a clear report identifying which AI apps are in use, what sensitive data has been entered, where that data is processed, and which incidents represent the highest risk to your business. Koncise walks you through the findings and recommends your next steps at no cost and with no obligation.

What is shadow AI and why is it a security risk?

Shadow AI refers to AI tools that employees are using without IT knowledge or approval - personal accounts on ChatGPT, consumer AI writing tools, AI features embedded in SaaS products, and more. The risk is that data entered into these tools - including confidential business information, HR records, legal documents, and source code - may be stored, processed, or used to train models in ways that violate your data governance policies, client contracts, or UK GDPR obligations. Unlike traditional shadow IT, shadow AI operates at the prompt level, meaning every interaction is a potential data exposure event.

What data does the AI Risk Assessment collect about my employees?

The assessment is designed to be privacy-first. It captures AI tool usage, the types of data being entered (categorised by sensitivity), and behavioural patterns at the user and department level. It does not involve keylogging or surveillance of non-AI activity. The assessment is built for regulated environments and includes configurable anonymisation, encryption at rest, and role-based access controls - so your security and compliance teams can review findings without exposing individual employee data unnecessarily.

How long does a free AI Risk Assessment take?

Most assessments run for three to four weeks, which gives sufficient time to capture AI usage patterns across your organisation and identify genuine behavioural trends rather than one-off activity. Deployment is lightweight and typically completed within a day. At the end of the assessment period, Koncise prepares your report and arranges a walkthrough session - usually within five to seven business days of the assessment closing.

What happens after the assessment?

You receive a clear, leadership-ready report from the Koncise team covering every area the assessment measured. We walk you through the findings in a dedicated session - no jargon, no scare tactics - and give you a prioritised set of recommendations. There is no obligation to take any further action or engage Koncise for ongoing services. For organisations that want to act on the findings, Koncise can help implement appropriate AI governance controls, usage policies, and technical guardrails as part of a broader human risk management programme.

Is an AI Risk Assessment relevant for my business?

If your employees have access to the internet and use any SaaS tools, AI is almost certainly already present in your environment - whether you have formally approved it or not. The assessment is particularly relevant for organisations with data protection obligations under UK GDPR, those operating in regulated sectors such as financial services, legal, or healthcare, businesses with client confidentiality requirements, and IT leaders who want to establish an AI governance baseline before rolling out internal AI policies. The assessment is free, so there is no cost to finding out where you stand.

What types of sensitive data are typically found in AI tools during the assessment?

In assessments run across UK organisations, common sensitive data types found in AI tools include HR records, infrastructure documentation, legal and contract details, business continuity plans, company strategy documents, source code and configuration files, and financial information. High-risk incidents typically involve credentials, API keys, or personally identifiable information being entered into consumer AI tools. The specific findings vary significantly by organisation and sector - which is exactly why the assessment is worth running.

How is this different from an AI policy or acceptable use review?

An acceptable use policy tells employees what they should do. An AI Risk Assessment shows you what they are actually doing. Most organisations discover a significant gap between policy intent and real-world behaviour - and without visibility, that gap is invisible until something goes wrong. The assessment provides the evidence base for building AI governance that reflects how your people actually work, rather than a policy written without data.

Resources

Keep It Koncise

Straight-talking cybersecurity insight. No jargon, no scare tactics - just what you need to know.

Human Centric Businesses Deserve Human Centric Security

Your job is genuinely hard right now.

Too big to ignore risk

Too small for enterprise overhead

Drowning in vendor noise

Justifying spend upward

Spending without proof

The Koncise Security Improvement Model

We're not a vendor.We're your team.

Don't take our word for it.

The Six Pillars of the Koncise Security Portfolio

Coverage built. Now let’s try to break it.

Ready to understand your real security position?

Questions & Answers

We Work With IT Leaders Facing Impossible Choices

Sound familiar?

Struggling to make security make sense to your board?

Drowning in threats with limited resources?

Security measures slowing down your systems?

Unable to see clear ROI on security spending?

It's not your fault.

Start with a Security Maturity Assessment

Real Questions, Straight Answers

The Koncise Portfolio

Know where you stand before you spend.

Know Where You Stand

Prioritise What Matters

Get Buy-In & Budget

The Koncise Security Improvement Model

The Six Pillars of the Koncise Security Portfolio

Detect & Respond to Threats 24/7

Stop Phishing & Human Risk

Secure Data & Prevent Loss

Protect Identity & Access

Patch, Harden & Reduce Attack Surface

Assurance & Compliance

Other Services

Coverage built. Now let’s try to break it.

What validation asks of each pillar

Fix what testing proves matters.

Configuration & hardening

People & process

Detection & architecture

Where we take you.

And the evidence to back it up

Not sure where to start?

Service & Fit Questions

Find Out Whether Your Security Actually Works

Assurance tells you what should be true.Validation tells you what is.

Step 03 of the Security Improvement Model

Three ways to find out.

Technology, people and process.

Technology

People

Process

What validation asks of each pillar

The finding is the finding.

Testing shouldn’t end at a PDF.

Test

Fix

Prove

Want to know if it actually holds?

Penetration Testing, Delivered by Our Own Team

Questions worth asking.

Scanning finds known weaknesses.Testing shows you how they can actually be used.

Four kinds of engagement.

External Penetration Testing

Internal Penetration Testing

Web Application Penetration Testing

API Penetration Testing

A test you can plan around.

A report someone will actually read.

Evidenced

Prioritised

Readable at both levels

Most testing stops at the report. Ours doesn't have to.

We understand the context

We can help fix it

We can prove it's closed

What affects the size of an engagement

We're not a vendor.
We're your team.

Assurance tells you what should be true.
Validation tells you what is.

Scanning finds known weaknesses.
Testing shows you how they can actually be used.

London
Security
Social