Cyber Security
Offerings / Security
Layered defence, from prevention to response.
THUSA Cyber Security is a managed security service for South African businesses, and it gives you prevention, detection and response across endpoints, network, email, cloud and people. It is built on NIST, ISO 27001 and CIS Controls. The 24/7 security operations centre sits in the Cyber Defence bundle. Start with the baseline. Add round-the-clock security monitoring when you are ready.
What THUSA cyber security delivers
THUSA Cyber Security brings prevention, detection and response together in one information security programme, in the way a managed security services provider would run it for you. A threat that gets past one control meets another. One successful attack can shut down operations, lose data, bring regulatory penalties and damage a reputation built over years. Layered defence answers that risk. The Defence bundle adds incident response and security monitoring around the clock.
THUSA's cyber security services cover ransomware, phishing, data breaches, insider threats and advanced persistent threats. A point solution covers one attack route, but these managed security services work together across endpoints, networks, email, cloud services and user behaviour. Cyber security goes beyond the perimeter.
Three frameworks anchor it. The cyber security programme rests on the NIST Cybersecurity Framework, ISO 27001 and CIS Controls. The information security work that defends against real attacks also produces the controls and documents that compliance asks for, so one effort serves both aims.
The operational security challenge
Attackers are organised and patient. They aim at the systems a business cannot do without. Six pressures turn cyber security into a board matter instead of an IT line item, and THUSA's managed security services are built around them.
Ransomware and extortion.
Modern ransomware steals data before it encrypts anything, so attackers demand payment twice: once to restore systems, once to keep the data off the internet. Backups are targeted on purpose.
Phishing and social engineering.
Email is still the main attack route. Spoofed domains and compromised accounts trick users into handing over credentials or approving fraudulent payments.
Supply chain and third-party risk.
A compromised update, a vulnerable application or a supplier's credentials can walk past perimeter defences, so information security must cover the whole ecosystem.
Insider threats and credential abuse.
Malicious insiders, careless staff and compromised credentials do real damage, and weak authentication makes unauthorised access easier.
Cloud and SaaS vulnerabilities.
Cloud adoption pushes the attack surface beyond the traditional perimeter. Misconfigured storage, insecure APIs and unmonitored cloud activity open gaps that cloud security monitoring has to close.
Compliance and regulatory pressure.
POPIA, ISO 27001, PCI DSS and industry regulations impose mandatory controls and significant penalties. Information security maturity must be shown through policies, technical controls and security monitoring, which the Defence bundle supplies.
Core cyber security capability areas
Protection is layered. No control has to be perfect. THUSA's managed security services cover eight layers of cyber security, and together they form one information security programme that runs from the endpoint to the cloud. Each layer says what it does and what it hands to the security operations centre.
Layer of the managed security service
What THUSA's cyber security services do
Endpoint protection and detection
Workstations and servers record process, file and network activity on the device, and malicious activity is isolated within seconds.
- Next-generation antivirus:
- machine learning blocks zero-day and fileless malware.
- Endpoint detection and response (EDR):
- records process, file, registry and network activity on the endpoint. In the Defence bundle, endpoint events also feed security monitoring.
- Ransomware-specific protection:
- suspicious encryption triggers isolation, often before damage is done.
- Automated threat response:
- infected endpoints are isolated and forensic evidence is collected.
Network security and access control
The perimeter is inspected, the inside is segmented so a breach stays small, and remote access is verified rather than trusted.
- Firewall management:
- intrusion prevention, deep packet inspection and application control.
- Network segmentation:
- separate segments for servers, workstations, guests and IoT limit lateral movement.
- VPN and remote access:
- multi-factor authentication, posture checks and conditional access, with session security monitoring.
- DNS security and web filtering:
- malicious domains are blocked at the DNS layer.
Email security
Several defences run in sequence on email, the main attack route, plus protection against your own domain being impersonated. This layer is also known as an email security gateway.
- Platform:
- typically Mimecast or Microsoft Defender for Office 365.
- Spam and malware filtering:
- known malicious email never reaches the inbox.
- URL protection:
- links are inspected at click time.
- Attachment sandboxing:
- suspicious attachments are detonated in isolation first.
- Impersonation protection:
- spoofed names, look-alike domains and CEO fraud are detected.
- Business email compromise:
- machine learning flags anomalous sending patterns and urgent requests.
- DMARC domain protection:
- only authorised servers can send as your domain.
- Continuity and archiving:
- email stays available during an outage, and archives support legal discovery.
Security operations centre
THUSA's cyber security monitoring services put a dedicated analyst team on watch 24/7 through a central SIEM, and once a threat is confirmed the analysts run the response. SOC monitoring comes in the Defence bundle or as a standalone component.
- 24/7 cyber security monitoring:
- endpoints, firewalls, email, cloud applications and network devices feed a central SIEM.
- Threat detection and analysis:
- analysts correlate events using behavioural analytics and threat intelligence.
- Incident response:
- isolate systems, gather forensic evidence, find root cause, remove the threat and coordinate recovery.
- Threat intelligence:
- global feeds become detection rules, threat hunting and prioritised patching.
- Monthly cyber security reporting:
- events, incidents and threat trends give executives a view of security monitoring results.
Vulnerability management
Weaknesses are found continuously, ranked by the risk they pose and closed through patching, and the scan reports double as information security audit evidence.
- Continuous scanning:
- servers, workstations, network devices and cloud environments are checked for known weaknesses.
- Risk-based prioritisation:
- exploitability, asset criticality and internet exposure set the order of information security work.
- Patch management integration:
- critical vulnerabilities are patched as an emergency outside maintenance windows.
- Compliance and audit support:
- scan results give information security evidence for ISO 27001, PCI DSS and POPIA.
Security awareness and user training
People are the most-targeted control, so they are trained monthly, tested monthly and tracked, with the completion records auditors ask for.
- Monthly cyber security awareness training:
- phishing recognition, password security, data protection and incident reporting.
- Monthly phishing simulations:
- anyone who clicks gets immediate remediation training.
- Security champions programme:
- optional advanced training for key people, who then advocate information security in their departments.
Data protection and backup security
Backups are hardened to keep ransomware away from them, workstation data is recoverable without paying anyone, and sensitive data is stopped from leaving by the usual routes.
- Endpoint backup and recovery:
- lost, stolen or ransomware-hit devices are restored without paying a ransom.
- Backup security hardening:
- immutable backups, air-gapped copies, dedicated credentials and restore testing.
- Data loss prevention:
- information security policies block sensitive data leaving by email, USB, personal cloud or print.
Cloud security
Microsoft 365 is hardened to CIS baselines, and in the Defence bundle cloud security monitoring watches for the behaviours that precede a breach. Third-party SaaS comes under the same access control.
- Microsoft 365 configuration:
- conditional access, enforced multi-factor authentication and CIS-aligned baselines.
- Cloud detection and response (Defence bundle):
- cloud security monitoring flags anomalous logins and risky app integrations, and accounts are blocked.
- SaaS application security:
- third-party SaaS joins single sign-on, with user activity logged and, in the Defence bundle, under security monitoring.
Service bundles
Start with the essentials, add SOC monitoring when you are ready, or take the full information security resilience programme with a dedicated account lead. Every bundle is a managed security service. Each builds on the one before.
← scroll the diagram →
Per user, per month
Cyber essentials bundle
What it addsThe baseline layer of cyber security protection.
What the managed security service includes- Endpoint protection (NGAV and EDR);
- email security: anti-phishing, URL protection and attachment sandboxing;
- security awareness training;
- monthly phishing simulations;
- vulnerability scanning;
- patch management.
Per user, per month
Cyber defence bundle
What it addsEverything in Essentials, plus 24/7 detection and response.
What the managed security service includes- All Cyber Essentials components;
- 24/7 SOC monitoring and incident response;
- cloud detection and response for Microsoft 365;
- dark web monitoring;
- monthly security reporting;
- quarterly penetration testing.
Custom pricing
Enterprise cyber resilience
What it addsEverything in Defence, plus information security governance, compliance and a dedicated account lead.
What the managed security service includes- All Cyber Defence components;
- dedicated security account management;
- advanced threat intelligence;
- data loss prevention (DLP);
- SIEM integration with business applications;
- compliance programme management (ISO 27001, SOC 2);
- executive security reporting.
How the bundles are priced
Cyber security is bundled per user, or bought component by component where you already have part of the picture, so the price fits what you actually need. The bundle sets the monthly number.
Bundled, per user.
Essentials and Defence are managed security services priced per user, per month. Enterprise Cyber Resilience is custom priced.
Standalone components.
Organisations that already run security infrastructure can buy cyber security services piece by piece: SOC monitoring, penetration testing, security assessments, compliance consulting or managed SIEM services.
Before you commit.
A complimentary security assessment covers current controls, vulnerability exposure, compliance gaps and prioritised recommendations, and a simulated phishing campaign or penetration test shows your information security exposure.
Security maturity roadmap
THUSA's managed security services build cyber security up in step with where your business is, not all at once, over four phases. Each phase adds to the last. Your information security maturity and your risk set the pace.
-
When
Months 1 to 3
PhaseFoundation
What the information security programme adds- Endpoint protection (NGAV and EDR);
- email security;
- firewall management;
- patch management and vulnerability scanning;
- multi-factor authentication;
- security awareness training;
- immediate risk reduction and an information security compliance baseline.
-
When
Months 4 to 6
PhaseEnhancement
What the information security programme adds- 24/7 SOC monitoring (the Defence bundle);
- phishing simulations;
- network segmentation;
- backup security hardening;
- cloud security posture management;
- a detection and response capability in place.
-
When
Months 7 to 12
PhaseOptimisation
What the information security programme adds- Threat hunting;
- red team exercises and penetration testing;
- security automation and orchestration;
- advanced DLP policies;
- continuous improvement and resilience.
-
When
Year 2 onwards
PhaseStrategic
What the information security programme adds- Board-level cyber security reporting;
- cyber insurance optimisation;
- a third-party risk management programme;
- security-by-design in development processes.
Who it is for
Five groups fit. Managed security services and cyber security services suit businesses where a breach would cost far more than an inconvenience, such as the five groups below.
Regulated industries.
Managed security services give financial services, insurance, healthcare, legal and professional firms the documented cyber security controls they need, with security monitoring from the Defence bundle.
Organisations handling sensitive data.
Customer information, financial data and intellectual property carry liability and regulatory risk if they leak, which is why information security sits at the centre of the service.
Businesses recovering from an incident.
After ransomware, phishing or a breach, managed security services can lift the cyber security posture quickly, and that bundle adds security monitoring to keep watch afterwards.
Companies without in-house expertise.
With no dedicated information security team, managed security services supply the cyber security analysts, engineers and penetration testers.
Cyber insurance requirements.
Where cyber insurance makes multi-factor authentication, EDR, backup security and awareness training underwriting conditions, these information security controls are the ones to have in place.
Get in touch
Not sure which of these describes you? Tell us about your business and we will point you to the right place to start.
Get in touchCase studies across sectors and outcomes
See how THUSA's managed IT services work out in practice, or browse all case studies.
The THUSA approach
THUSA treats cyber security as a capability that has to keep improving, not a set of products you buy once and leave running. There are four steps. Its managed security services follow them: Assess, Prioritise, Implement and Continuously Improve.
Assess.
Find out what is exposed: where access has drifted, where governance has fallen behind and how ready the organisation is to keep operating if something goes wrong.
Prioritise.
Rank the work by business impact, how exposed a gap already is, how likely the threat is, compliance obligations, recovery speed and your own priorities.
Implement.
Close the gaps the assessment found: endpoint protection, email security, Microsoft security hardening, SOC monitoring onboarding, governance alignment and vulnerability remediation.
Continuously Improve.
Review security maturity on an ongoing basis. Security monitoring reports from the Defence bundle, vulnerability assessments, governance reviews, threat analysis and phishing simulation metrics all feed back into what happens next.
Technology keeps changing. Cyber security has to keep pace, so each review of posture, vulnerabilities and threats feeds the plan for the next round of work.
Why THUSA cyber security
THUSA delivers more than security tooling. These are THUSA's own figures for the business as a whole, rather than for any single bundle or managed security service:
25+
Years in operation.
99.95%
Uptime achieved, through proactive monitoring and preventative maintenance.
15 minutes:
The average response time for critical incidents.
24/7
Cover from an operations team, a security team and a monitoring centre.
Bundles differ. Which of these figures applies to your managed security service depends on the bundle you choose and on the components you add to it.
Next steps
Find out first. Learn where your cyber security stands before an attacker does, through a complimentary assessment or a simulated phishing campaign or penetration test.
Request a security assessment from THUSA. To see how cyber security fits the wider picture, read about IT maturity, and for what happens if something does get through, read about business continuity.
Security assessment.
A complimentary assessment of your current information security controls, vulnerability exposure, compliance gaps and prioritised recommendations.
Threat simulation.
A simulated phishing campaign or penetration test shows your current cyber security weaknesses and how your users respond.
FAQ
Does THUSA provide 24/7 cyber security monitoring services?
Yes, in the Cyber Defence bundle of THUSA's managed security services. It adds 24/7 SOC monitoring and incident response to Cyber Essentials, and SOC monitoring can also be bought on its own as a standalone component. Analysts watch around the clock. Events from endpoints, firewalls, email, cloud applications and network devices feed a central SIEM. Once a threat is confirmed, the analysts run the response.
What is the difference between managed security services and a once-off security audit?
The difference is what happens next. Under THUSA's managed security services, vulnerabilities are scanned continuously. They are ranked by how easily they can be exploited, how critical the asset is and how exposed it is to the internet. Critical ones are patched as an emergency, outside maintenance windows. To see where you stand first, THUSA offers a complimentary security assessment of your information security controls and compliance gaps.
What does an information security programme include?
THUSA's managed security services include an information security programme. It has eight layers. They are endpoint protection, network security, email security, a security operations centre, vulnerability management, awareness training, data and backup protection, and cloud security. The programme is built on NIST, ISO 27001 and CIS Controls. So the cyber security work that defends against attacks also produces the documents compliance needs.
Can THUSA help with POPIA compliance?
Yes, on the technical side. THUSA's managed security services give you evidence for ISO 27001, PCI DSS and POPIA through vulnerability scan results and regular reporting. Compliance consulting can also be bought as a standalone component. For POPIA programme guidance, see Strategic Advisory. For formal POPIA sign-off, involve your legal or compliance adviser.
Do you support businesses outside South Africa?
THUSA describes its reach as service through its branches and partner networks, including South Africa, Lesotho, Namibia, Zambia and the United Kingdom, among other countries. Operating in several markets? Say so. When you request a security assessment, name the countries you work in, and ask which cyber security services apply there.
Stop managing IT.
Start relying on it.
Ready when you are
THUSA cuts IT downtime and lifts efficiency. Tell us about your business. Talk to a managed IT services provider that takes ownership.