Business promise
Less audit theater, more real resilience
The cybersecurity page sells not a certificate, but the ability to survive an incident: detect, contain, recover and prove control to the regulator.
Critical infrastructure protection, compliance with NIS2 and ISO/IEC 27001. No auditor-checkbox approach — real defense that holds against real attacks.
Cybersecurity is not "buy antivirus and SIEM". It is an organizational discipline starting with threat modeling, going through architectural decisions (Zero Trust, segmentation, IAM) and ending with operational processes (incident response, threat hunting, regular audit).
Regulatory compliance (NIS2, ISO/IEC 27001, GDPR) is a separate competency at risk of becoming an "auditor checkbox". We combine both worlds: technically reliable defense that simultaneously passes formal compliance.
The cybersecurity page sells not a certificate, but the ability to survive an incident: detect, contain, recover and prove control to the regulator.
Tools may be purchased, but if access review, incident response and ownership do not live in processes, defense remains a facade.
We start with assets, attack scenarios and control gap analysis. Only then decide what to buy, tune or change organizationally.
Instead of rewriting legacy, we wrap it in defense layers: identity-aware proxy, micro-segmentation, enhanced traffic monitoring. This is not "true" Zero Trust, but it works.
We do not do "certification in 2 months" — that is cosmetic. We do 6–9 month implementations, after which certification becomes a natural next step.
Before scaling a SOC, we optimize the noise ratio. Target state — 5–10 actionable alerts per day, each one actually reviewed by an analyst.
It is more honest to say "you do not need this yet" than to sell an engagement that will not deliver ROI.
Asset and data inventory, threat modeling, IAM audit, gap analysis of existing controls against ISO/IEC 27001 / NIS2 baseline.
Roadmap for Zero Trust (where realistic), segmentation strategy, IAM modernization, SIEM/SOAR tuning. With effort estimates and prioritization.
MFA enforcement, privileged access management, basic segmentation, SOC noise reduction. No architectural changes — closing the most obvious gaps.
ISMS documentation, controls, audit trail, regular reviews. Prepares for ISO/IEC 27001 certification or NIS2 compliance.
Threat hunting, periodic penetration testing, incident response drills, threat model updates. Without this, compliance degrades within 12 months.
Project lead: Softline (cybersecurity, compliance).
Brought in when needed: SL Global Service (security in cloud), IQusion (public sector), Softengi (AI-based threat detection).
The client buys an enterprise SIEM expecting it to catch incidents on its own. Six months later — 500 alerts a day, 99% false positives. Analysts ignore everything.
What we do instead: SIEM tuning before production — mandatory 4–6 weeks. Target state: <10 alerts/day with actionable rate >50%.
The team reads a Forrester report on Zero Trust and starts rewriting the ERP. The project takes 2 years, budget ×3, result — half migrated, half is the old architecture with friction at the boundary.
What we do instead: for legacy — Zero Trust as a wrapper (identity-aware proxy + micro-segmentation), not a rewrite. Rewrite is a separate decision with its own ROI case.
Consultants write policy documents, pass the audit, get the certificate. Six months later, the documents reflect nothing real that is actually happening.
What we do instead: first implementation (6–9 months), then certification. Documents follow real processes, not the reverse.
After 5 years of company growth, each employee has 30+ permissions, of which only 5 are actually used. A terminated employee retains access for 3 months after leaving.
What we do instead: periodic access review (quarterly), role-based access as default, off-boarding automation via HR trigger.
Each example shows the client-side story: what was getting in the way, what changed, and what result the team got.
Nine recent expert articles — from thematic overviews to specific architectural decisions.
Splunk · Microsoft Sentinel · IBM QRadar · ArcSight · LogRhythm · Elastic Security
Okta · Microsoft Entra ID · Ping Identity · CyberArk · BeyondTrust · HashiCorp Vault
Cisco Firepower · Palo Alto · Fortinet · Cloudflare Zero Trust · Zscaler
CrowdStrike · SentinelOne · Microsoft Defender for Endpoint · Carbon Black
Tenable · Qualys · Rapid7 · OWASP ZAP · Burp Suite
ISO/IEC 27001 · NIS2 · GDPR · NIST CSF · CIS Controls · КСЗІ
NIS2 is EU Directive 2022/2555, in force since October 17, 2024. Applies to operators of critical infrastructure: energy, transport, banking, healthcare, digital services, water supply, waste, food industry, manufacturing, digital infrastructure. Mandatory for Ukrainian companies doing business in the EU.
The certification itself (audit) — from $15k to $50k depending on organization size. Implementation that precedes certification — $100k–$500k+ depending on current security state. Certification is impossible without implementation.
SIEM is a tool that collects logs and generates alerts. SOC is the team of people that responds. Without SOC, your SIEM is an expensive dashboard nobody reviews. In 2026, a typical enterprise has: SIEM + in-house L1/L2 team + outsourced L3 for complex incidents.
KSZI is the comprehensive information protection system, a Ukrainian legal requirement for government information systems handling restricted-access data. If you integrate with government registries or process government data — KSZI attestation is mandatory.
Not as a rewrite. As a layered approach: (1) identity-aware proxy in front of legacy; (2) micro-segmentation at network level; (3) enhanced audit logging; (4) JIT access via PAM. This is 60–70% of Zero Trust benefit without legacy code changes.
Standard flow: detect → contain (isolation) → eradicate (threat removal) → recover → lessons learned. The first 24 hours are critical — damage scope depends on this. NIS2 requires initial notification to the regulator within 24 hours of detection.
Real projects rarely fit in one competency. See which other areas we work in.
30-minute discovery call with a security architect. No commitments and no NDA at this stage.
Intecracy Group does not force a single delivery team. We clarify the task, identify the required competencies and help involve the relevant alliance members.