Defined work. Visible output.
Open source gets you the code. RTFM helps you decide what belongs in your environment, deploy it without hand-waving, and keep it operable after the first dashboard looks impressive.
Architecture & risk review
For teams deciding what to build, replace, harden, or stop pretending is temporary.
What is included- Current-state and constraint review
- Trust boundaries, failure paths, and operational risks
- Tool and architecture decisions, with rejected alternatives
- Prioritised implementation sequence
A written decision record, architecture diagrams, a risk register, and an implementation estimate.
Hardened deployment
For teams that want an In a Box blueprint adapted to their real network, identity, data, and recovery requirements.
What is included- Scoped deployment of one or more blueprints
- Secrets, TLS, identity, network, and least-privilege hardening
- Monitoring, backup, restore, and failure-path verification
- Operator handover and an environment-specific runbook
A running, tested deployment; source-controlled configuration; evidence of recovery; and a clean handover.
Ongoing operations
For small teams that own the stack but need experienced review and operational depth without hiring another full-time role.
What is included- Upgrade, vulnerability, and configuration review
- Backup and recovery evidence checks
- Change review and architecture guidance
- Incident support within an agreed response window
A named operator, a monthly evidence report, an ordered improvement queue, and fewer “we should probably check that” items.
Teams that want ownership, not outsourcing theatre.
Good fit
- Small infrastructure, platform, or security teams
- Self-hosted or hybrid environments
- A real operational problem and access to decision-makers
- Teams willing to maintain explicit runbooks and recovery paths
Not the offer
- A staffed 24×7 SOC or generic help desk
- Compliance certification sold as a checkbox
- A black-box managed service you cannot inspect
- An unpaid week of discovery disguised as a sales call
Not a magic button. A better starting point.
These engagements reduce integration toil and leave you with systems you can inspect. They do not abolish capacity planning, threat modeling, backups, or knowing your own environment. “Zero complexity” is marketing nonsense. Visible complexity with useful defaults is something an engineer can actually operate.
When a tool is an IDS rather than an inline IPS, the documentation says so. The same applies to scope: if the work is not a fit, you will be told during the first exchange, not after an invoice.