What cyber security companies do, stripped of the acronyms, is sell five things: they watch (monitoring of networks, devices and mail for signs of compromise, around the clock), they respond (containing and cleaning up an incident when one happens), they test (probing your systems the way an attacker would and reporting what gave), they certify (helping you meet a standard or a client's security questionnaire), and they advise (deciding what a sensible programme looks like for your size and risk). Every service on every provider's site is one of the five wearing a trade name. For the owner or office manager doing the buying, the useful move is to translate each proposal line back into which of the five it is, because the five have very different prices and very different substitutes. This page does that translation and points to the guides on this site that price each one; the written programme the provider will ask you for on day one is what the free policy sheet sizes.
Watching and responding, the managed core
Around-the-clock monitoring with response attached is the core of the managed security market, sold as managed security services or managed detection and response. The provider's analysts watch telemetry from your devices, network and mail, triage the alerts, and act on the real ones under an agreed procedure. It is the service a small organisation is least able to substitute internally, because the value is the overnight shift nobody on staff works. The managed IT security guide on this site walks scope and the pricing guide walks the per-user and per-device models with two licensed list prices for scale.
Testing and certifying, the periodic work
Testing is periodic rather than continuous: a vulnerability assessment scans for known weaknesses, a penetration test pays a human to chain them into an actual break-in, and the deliverable is a report your next audit cites. Certification work maps your controls against a framework, the NIST Cyber Security Framework among them, or against a client's questionnaire, and closes the gaps. Both start by asking for your written policies, which is the day-one document request the free sheet on this site prepares you for: the policy set, counted from your facts, with the drafting cost priced at your own hourly figure.
Advice, and what stays yours
The advisory service, sold as virtual CISO or security consulting, decides what the programme should be: which risks matter, which controls are worth their cost, what the policies commit to. It is also the service where a small organisation should keep the most ownership, because the judgements, how much risk to accept, what the coverage budget is, belong to the owner, not the vendor. Hardenvo Pro holds that boundary: the policy set and the plan are generated from your answers and filed with review dates, so what the provider gets is a written programme to execute against, and what you keep is the decisions.
Questions people ask about what do cyber security companies do
What services do cyber security companies provide?
Five: monitoring, incident response, testing (vulnerability scans and penetration tests), compliance and certification help, and advisory work. Every offering on a provider's menu is one of the five under a trade name, and pricing them separately is how a proposal becomes comparable.
What is the difference between monitoring and testing?
Monitoring is continuous watching of your live systems with response attached; testing is a periodic engagement that probes for weaknesses and hands you a report. A small organisation typically buys monitoring monthly and testing annually or before a big client audit.
What will a cyber security company ask me for first?
Your written security policies and an inventory of systems and data. Providers scope and price against them. The free sheet on this site counts the policy set your facts call for, and Hardenvo Pro generates the documents so the engagement starts from a written programme.