Cybersecurity
Cybersecurity services
TwoDefend delivers managed detection, 24/7 support, SIEM engineering, on-site firewall and network work, endpoint and email protection, identity security, staff training, and compliance hardening from Skopje for organizations across North Macedonia, the Balkans, Europe, and the United States. European teams migrating off Microsoft 365, Google Workspace, or Azure to sovereign open-source stacks can add managed SIEM monitoring, NIS2 Article 21 programs, and migration security assessments without losing enterprise-grade protection.
Managed Security & SOC
We watch your environment around the clock with AI-assisted triage, tune your SIEM, and run hands-on incident response when alerts matter, so your team is not alone at 2 a.m.
What we deliver
- 24/7 or business-hours monitoring and support (by program tier)
- AI-assisted alert triage and threat correlation
- SIEM design, deployment, and ongoing tuning
- Threat detection, proactive hunting, and ransomware containment
- Hands-on incident response, remote and on-site when required
What that means for you
- AI-assisted detection with human analysts in the loop
- Detection rules aligned to your real attack surface
- Containment and recovery playbooks for ransomware and intrusions
- Clear escalation paths and runbooks you can rehearse
- Monthly reporting executives actually read
- Vendor-neutral SIEM support (Splunk, Sentinel, Elastic, open platforms, and more)
- Evidence-friendly logging for audits
Network Security
On-site firewall and network hardware deployment, plus IDS/IPS, VPN, and traffic analysis, with logs flowing into the same SIEM your analysts already use.
What we deliver
- On-site firewall installation, mounting, and management
- Physical network hardware deployment and secure architecture
- IDS/IPS monitoring
- VPN security and access control
- Network traffic analysis
- Intrusion detection and escalation
What that means for you
- On-site firewall and security appliance installation
- Router, switch, and network equipment setup at your location
- Firewall log collection and correlation
- Rule auditing and optimization
- Suspicious traffic and anomaly detection
- VPN session monitoring
- Alert escalation to the SOC
Security Hardening, Assessments & Compliance
Assessments, gap analysis, and remediation across cloud, identity, endpoints, and network, aligned to NIST, ISO 27001, CIS, PCI DSS, GDPR, and North Macedonia cyber law readiness.
What we deliver
- Cybersecurity assessments and security audits
- Risk management and vulnerability management programs
- Security policies, procedures, and incident response planning
- Baseline and maturity assessments with prioritized remediation
- Compliance readiness (NIS2-aligned law, PCI, SOC 2, HIPAA-style frameworks)
- Hardening guides for servers, workstations, and SaaS
- Privileged access and admin surface reduction
What that means for you
- Prioritized fix lists your IT team can execute
- Before/after evidence for leadership and auditors
- Alignment with CIS Critical Security Controls and OWASP where applicable
- Hands-on implementation support on Premium programs
- Coordination with SOC and SIEM so changes are monitored
- Quarterly roadmap tied to your risk priorities
Endpoint Security
Modern endpoint detection and response: behavioral detection, automated containment for ransomware, and policies coordinated with the SOC.
What we deliver
- EDR / XDR coverage (vendor-flexible)
- Ransomware detection and automated containment
- Device hardening and policy enforcement
- Automated threat isolation and remediation
What that means for you
- Behavioral threat detection on laptops and servers
- Real-time alerting to SOC analysts
- Automatic isolation of compromised endpoints
- Policy enforcement aligned to your EDR platform
- Joint playbooks with your internal IT team
Email Security
Protect Microsoft 365 and Google Workspace inboxes from phishing, BEC, and malware. Serious threats go to analysts who understand your business.
What we deliver
- Microsoft 365 security
- Google Workspace security
- Phishing and malware protection
- Business email compromise (BEC) detection
- Inbox and forwarding rule monitoring
What that means for you
- Phishing link and attachment analysis
- Email impersonation detection
- Malicious inbox monitoring
- Domain spoofing detection
- SOC escalation for confirmed email threats
Identity and Access Security
Harden sign-in with MFA, conditional access, privileged access management, and continuous monitoring of admin activity.
What we deliver
- Microsoft Entra ID (Azure AD) management
- Google Workspace admin security
- Multi-factor authentication (MFA) enforcement
- Conditional access policies
- Privileged access management (PAM)
What that means for you
- User and account lifecycle guidance
- Role and permission design
- Admin access control
- Suspicious sign-in detection
- Access policy enforcement and admin activity tracking
Security Awareness Training
Turn your workforce into a human firewall. Role-based modules, live and on-demand sessions, and reporting leadership can use for compliance and board updates.
What we deliver
- Role-based modules for finance, HR, executives, and general staff
- Live instructor-led sessions and on-demand video libraries
- Completion tracking by team, department, and individual
- Compliance reporting for audits, cyber insurance, and frameworks
- Refresher cycles aligned to your risk profile and incident trends
What that means for you
- Practical content your employees remember, not checkbox videos
- Campaigns tied to recent phishing results or policy changes
- Executive summaries with completion rates and knowledge gaps
- Bundled with Professional and Premium; optional add-on for Essential
- Coordinated with phishing simulations so coaching follows real behavior
Phishing Simulations
Safe, realistic phishing tests that reveal where staff need coaching, without shame. Templates, scheduling, automatic follow-up, and leadership-ready metrics.
What we deliver
- Realistic campaign templates (BEC, payroll, MFA fatigue, vendor fraud)
- Click-rate and credential-entry tracking with trend lines over time
- Automatic coaching for clickers: micro-lessons and safe landing pages
- Flexible scheduling: one-off, quarterly, or rolling campaigns by department
- Leadership reporting with risk heat maps and improvement benchmarks
What that means for you
- Industry-aligned scenarios that mirror attacks targeting your sector
- Repeat-clicker workflows that escalate coaching, not punishment
- Executive summary after each campaign with recommended next steps
- Integration with awareness training for high-risk groups
- Included in Professional and Premium; optional add-on for Essential
Sovereign Stack Security
Managed security for businesses running European open-source and self-hosted stacks. When you leave Microsoft Defender and Entra ID behind, we monitor and protect Nextcloud, Linux desktops and servers, self-hosted email, Keycloak, and FreeIPA with SIEM and human analysts.
What we deliver
- SIEM deployment, tuning, and 24/7 or tiered monitoring
- Nextcloud, Linux endpoint, and self-hosted mail log onboarding
- Keycloak and FreeIPA identity event correlation
- Threat detection and incident response for open-source stacks
- Hardening guides aligned to CIS benchmarks for Linux and self-hosted apps
What that means for you
- MSSP for Nextcloud and European sovereign cloud environments
- Linux endpoint security managed service with analyst escalation
- Detection rules for ransomware, brute force, and data exfiltration on self-hosted platforms
- Integration with OVHcloud, Hetzner, and on-prem hybrid hosting models
- Vendor-neutral counsel: we secure your stack, not resell a US platform
- Monthly reporting for leadership and EU data residency stakeholders
NIS2 Compliance-as-a-Service
Managed monthly program covering NIS2 Article 21 requirements: risk assessments, incident detection, 24-hour and 72-hour reporting workflows, documentation, supply chain review, and continuous monitoring. EU fines reach €10 million or 2% of global turnover for non-compliance.
What we deliver
- NIS2 Article 21 risk management and policy documentation
- 24-hour early warning and 72-hour incident notification playbooks
- Continuous monitoring tied to SIEM and SOC operations
- Supply chain and vendor security review cadence
- Audit-ready evidence packages for essential and important entities
- Alignment with North Macedonia NIS2-aligned law and EU NIS2 Directive
What that means for you
- NIS2 compliance managed service without hiring a full GRC team
- Incident detection and reporting timelines your legal team can execute
- Executive dashboards on control maturity and open gaps
- Coordination with MKD-CIRT or EU national CSIRT reporting where applicable
- Staff training and phishing simulations counted toward resilience measures
- Quarterly roadmap prioritized by enforcement risk and insurer expectations
Migration Security Assessment
One-time paid engagement for businesses mid-migration off Microsoft 365, Google Workspace, Azure, or other US hyperscaler stacks. We audit the security gaps created during transition and harden the new environment before go-live.
What we deliver
- Pre-migration security baseline and gap analysis
- Identity, email, and endpoint control mapping (Entra ID, Defender, conditional access replacements)
- Cutover-window threat model and rollback planning
- Post-migration hardening for Nextcloud, LibreOffice, Linux, and European hosting
- SIEM and monitoring design for the new stack
- Executive readout with prioritized remediation and MSSP handoff options
What that means for you
- Security after leaving Microsoft 365: structured assessment, not guesswork
- Findings your IT team and leadership can act on before DNS cutover
- Comparison of lost Microsoft security features vs. open-source replacements
- Optional follow-on: Sovereign Stack Security or NIS2 Compliance-as-a-Service
- Delivered remotely with on-site option for North Macedonia and Balkan clients
- Fixed-scope proposal with clear timeline and evidence deliverables
See which program fits
Compare MSSP programs or tell us your priorities. We respond with a clear proposal.