AI that defends you
AI-Driven Threat Detection Autonomous Alert Triage Microsoft Security Copilot Deepfake & Voice Fraud DefenceSecurity for the AI you adopt
Copilot Readiness Assessment Shadow AI Discovery AI Governance & Policy LLM Application Security TestingCybersecurity · New Zealand
Governance, testing, protection, detection, response and recovery - built on the frameworks the rest of the world already agreed on, operated around the clock, and sharpened by AI that reads what people cannot read fast enough.
Analysts on shift. AI clears the noise; people make the call.
Zero Trust rules enforced. Every sign-in checked against risk.
Copilot grounded. Shadow AI monitored. Prompt injection tested.
Last restore test passed. Copies immutable and out of reach.
We design to NIST CSF 2.0 and CIS, then choose the tools. Not the other way round.
24/7 monitoring, certified responders and offensive testers - under one agreement.
AI sharpens our detection. It also creates risk you now have to govern. We do both.
Your architecture, your roadmap and your outcome sit with a team you can call.
The foundation
We did not invent a security model and give it a name. Everything we design, measure and report against comes from published international standards - so your progress means something to an auditor, an insurer, and the large customer who is about to send you a security questionnaire.
Strategy, roles, policy and reporting. The function most businesses skip, and the one insurers now ask about first.
Asset and data discovery, risk assessment, supply chain, and testing that finds it before an attacker does.
Identity, devices, email, data, network and people - configured to a benchmark, then kept there.
Monitoring, log retention, behavioural analytics and hunting, with coverage mapped to MITRE ATT&CK.
Containment, forensics, communications and the decisions that need to be made under pressure.
Immutable copies, tested restores, and a continuity plan that names who does what.
Alignment means we design, measure and report against these standards. Where you need certified attestation — ISO 27001 certification, SOC 2, PCI DSS — we prepare you for it and work alongside the certifying body. How each framework is used →
The practice
Security gets bought in pieces - a firewall here, a backup there, a test once because a customer insisted. The pieces do not add up to a defence. This is the whole practice, organised the way the NIST Cybersecurity Framework organises it, so nothing important sits in the gap between two suppliers.
DISCIPLINE 01GOVERN
Security decisions belong to the business, not to the IT budget. This is where they get made, written down and owned.
DISCIPLINE 02IDENTIFY
Assuming you are secure is not the same as knowing. This is how you find out on your terms rather than someone else's.
DISCIPLINE 03PROTECT
The controls that stop the ordinary attacks - set up to a benchmark, then kept there as your business changes.
DISCIPLINE 04DETECT / RESPOND
Prevention fails eventually. What decides the outcome is how quickly someone competent notices and acts.
DISCIPLINE 05RECOVER
The discipline that decides whether an incident is a bad afternoon or the reason a business does not reopen.
DISCIPLINE 06BOTH DIRECTIONS
AI is now on both sides of the fight. It makes our detection sharper, and it hands your business a new set of risks to govern.
AI that defends you
Security for the AI you adopt
AI security · both directions
Attackers use AI to write phishing that reads perfectly in New Zealand English and to clone a director's voice from a conference recording. Meanwhile your own business is adopting AI faster than it is governing it. Both of those are our problem.
AI that defends you
Security for the AI you adopt
Detect & respond
Microsoft Defender will tell you something is wrong. If that lands in a mailbox nobody opens on a Sunday, it may as well be switched off. Our security operations team reads every alert, decides which ones matter, and starts containing the ones that do before you have heard about it.
Including public holidays and the fortnight over Christmas, when offices are empty and incidents are not.
AI narrows the list. An analyst decides. You are never told a machine made the call about your business.
Identity, endpoints, email, cloud and web - watched as one picture, not five consoles nobody correlates.
Detection coverage measured against the MITRE matrix, so gaps are named rather than assumed away.
Service commitments shown are the intended standard and are written into your service agreement.
How we deliver
No security firm of any size does everything in-house, and the ones that claim to are usually thin somewhere. We would rather tell you exactly how this works, because when an insurer or a large customer asks who performs the work, you should have a straight answer ready.
STAYS WITH US
The design, the roadmap, the configuration of your environment, the detection rules, the relationship and the accountability sit with Be Secure. That does not get subcontracted, and it does not change when a supplier does.
DELIVERED WITH PARTNERS
Round-the-clock monitoring capacity, offensive testing, digital forensics and threat intelligence are delivered with accredited specialist partners, under our service levels and our contract with you.
WHY IT IS BETTER
A New Zealand business your size cannot fund a night shift, a forensics practice and a testing team. Through this model you get all three at a price that makes sense, without managing four vendor relationships.
WHAT WE PROMISE
Ask us who performs any part of your service and we will tell you, in writing, with their accreditations. One contract, one team who knows your setup, one number to call - and no suppliers pointing at each other.
Security check · 2 minutes
These are the controls we see missing most often, drawn from the ACSC Essential Eight and the CIS Critical Security Controls. Answer honestly - nothing is sent anywhere, and there is no form to fill in first.
Without it: a password stolen in someone else's data breach is the only thing between an attacker and your email, your invoices and your bank details.
What we do Multi-factor authentication across Microsoft Entra ID with conditional access by device, location and risk - tuned so it does not nag your team all day.
Without it: if your backup drive is plugged in, or your backup sits on the same network as your files, it gets encrypted at the same time as everything else.
What we do An immutable copy outside your tenant, on separate credentials, that cannot be changed or deleted even with your administrator account.
Without it: a laptop taken from a car stops being a hardware problem and becomes a notifiable privacy breach you have to report and explain to customers.
What we do Enrol every device in Microsoft Intune, encrypt the disk, and hold a remote wipe you can trigger in under a minute.
Without it: Defender will tell you something is wrong. If that lands in a mailbox nobody opens at 2am on a Sunday, it may as well be switched off.
What we do Alerts go to our security operations team. AI clears the noise, an analyst decides, and you only hear from us when it genuinely needs you.
Without it: an out-of-date plugin is the most ordinary way a small New Zealand site gets defaced, or quietly turned into somebody else's spam relay.
What we do Managed patching on a measured schedule, a web application firewall in front of the site, automatic certificate renewal and daily off-site copies.
Without it: a backup nobody has ever restored is a guess. Plenty of businesses discover on their worst day that the job had been failing quietly for months.
What we do Run a real restore twice a year against your agreed recovery time objective, and give you the written result.
Incident response
Every provider sells prevention. Very few will tell you what happens on the day it fails. This is the sequence we work to, and on the Managed 24/7 plan it is included — you are not billed an emergency rate on your worst day.
0 - 15 MIN · DETECT
The alert reaches an analyst on shift, not an inbox nobody is watching. Detection does not wait for you to notice.
15 - 60 MIN · CONTAIN
Affected accounts and devices are isolated from everything else, so it stops spreading while we work out what it is.
SAME DAY · INVESTIGATE
Forensic timeline, what was reached, what was not - and whether the Privacy Commissioner or your customers need to be told.
SAME DAY · RECOVER
Clean data from an immutable copy the attacker could not touch, restored against your agreed recovery time objective.
WITHIN A WEEK · LEARN
A written post-incident review, the control change that stops a repeat, and a detection rule so we catch it earlier next time.
Plans
The operating services - protection, detection, backup and recovery - are priced per person, per month, set up and run by us. Advisory and testing work is quoted per engagement, because a penetration test or a vCISO day is not a per-user product and any firm that prices it that way is selling you something else.
The baseline controls, genuinely configured rather than mostly switched on.
CIS Controls IG1 · Essential Eight Level 1
$29 per user / month
+ GST · minimum 5 users
Protection, backup and a security team watching during business hours.
CIS IG2 · Essential Eight Level 2 target
$59 per user / month
+ GST · minimum 5 users
A full security operation for businesses that cannot afford a quiet weekend to become a long month.
CIS IG3 track · ISO 27001 evidence ready
$109 per user / month
+ GST · minimum 10 users
Quoted per engagement, never per user: virtual CISO, security strategy and roadmap, cyber risk assessment, ISO 27001 readiness, penetration testing, red and purple team, social engineering testing, cloud and architecture review, digital forensics, AI governance and LLM application security testing.
Microsoft licences are quoted separately at the current New Zealand rate, so you always see what is our fee and what is Microsoft's.
Why Be Secure
Most New Zealand businesses sit in one of the first two columns and assume they are in the third.
| Nobody looking after it | A general IT provider | Be Secure | |
|---|---|---|---|
| Where the design comes from | Whatever was set up years ago. | The products they resell. | NIST CSF 2.0 and CIS, then the products that fit. |
| Who sees the alert | Nobody. It sits in a mailbox. | Whoever picks up the ticket that day. | An analyst on shift whose whole job is reading them. |
| Out of hours | Monday morning. | Monday morning. | Someone is on it while you sleep. |
| Being tested | Never, until an attacker does it. | Not offered. | Pen tested and assessed on a schedule you choose. |
| Microsoft 365 backup | Assumed to be Microsoft's job. | Sometimes included, rarely tested. | Off-tenant, immutable, restore-tested twice a year. |
| AI risk | Not on the radar. | Sells you Copilot licences. | Fixes the oversharing first, then governs what you switch on. |
| Who owns the risk | Nobody has written it down. | You do, without knowing it. | A named person, in a register, reviewed on a date. |
| What you can prove | Nothing. | Invoices. | An evidence pack your insurer and auditor will accept. |
| What it costs to find out | Days of trading, and the phone calls after. | An emergency rate, at the worst moment. | A fixed monthly fee, agreed in advance. |
Getting started
STEP 01 · ASSESS
Forty-five minutes. We measure what you have against NIST CSF 2.0 and the Essential Eight, and tell you the three things that matter most - not the three things easiest for us to sell.
STEP 02 · PLAN
What we would change, in what order, what it costs and what each change actually prevents. Sequenced by risk reduced per dollar. One page you could hand to a board.
STEP 03 · DEPLOY
Most of it happens without your team noticing. The parts they will notice - the sign-in change, mainly - we introduce with a short guide and a named person to ask.
STEP 04 · OPERATE
Alerts triaged as they arrive, restores tested on schedule, controls re-measured each quarter - and an evidence pack that grows, so the next questionnaire takes an hour rather than a fortnight.
Questions
For most New Zealand businesses: NIST CSF 2.0 to organise the conversation, the CIS Controls or the Essential Eight to decide what to do next, and ISO 27001 only if a customer or a regulator is asking for certification. Working to three frameworks at once is a common and expensive mistake. We will tell you which one your situation calls for, and it is usually one.
We own your architecture, your detection rules, your roadmap and the outcome. Overnight monitoring capacity, offensive testing and digital forensics are delivered with accredited specialist partners under our service levels and our contract with you. That is how a practice this size gives you a genuine night shift and a genuine forensics capability. Ask us who performs any part of your service and you get a straight answer in writing.
Two specific things. First, AI reads the alert volume and clears the noise, so analysts spend their hours on real incidents - that is measurable in how fast we get to something. Second, and more urgently for most businesses, the AI you are adopting is a new risk that needs governing. A person makes every decision that affects your business, and you can see what was flagged, what was cleared and why.
Fix your permissions. Copilot inherits exactly what each person can already reach, so if a folder was shared too widely years ago and nobody noticed, anyone can now simply ask for what is in it. A readiness assessment finds the oversharing, we fix it, we apply sensitivity labels and loss prevention rules, and then you switch it on. Doing it in that order is the difference between a successful rollout and a stalled one.
A penetration test finds as many weaknesses as possible in an agreed scope, and you get a list to fix. A red team picks an objective - reach the payroll data, for example - and tries to get there without being caught, which tests your detection and your people as well as your systems. Most businesses want the test first and the red team once the obvious things are closed.
Microsoft 365 gives you genuinely good security tools. It does not turn them on, tune them for your business, or read the alerts they produce - and it does not back up your data. Most businesses we take on are already paying for controls they have never switched on.
Almost nothing that reaches a small business was aimed at it. Attacks are automated, they scan everything, and they take whatever answers. AI has made the convincing phishing email free to produce, which removed the last reason to skip small targets. Being small is not cover - it usually just means nobody is watching.
No. Plans are month to month. If you leave, we hand over your documentation, your detection rules and your backup copies rather than holding them hostage.
Book a security review
We will measure what you have against NIST CSF 2.0, tell you the three things worth fixing first, and put it in writing. No charge, and no obligation to buy anything afterwards.
