MANAGED CYBERSECURITY · KENYA
Managed cybersecurity. Clear responsibility at every layer.
A business can have security software and still have gaps in access, configuration, alert handling or recovery. Start with the systems your operations depend on, the risks that matter and the people accountable for each control.
A CONNECTED SECURITY VIEW
- Business priorities
- Identity & people
- Devices & networks
- Cloud & data
- Detection & recovery
Begin with the business exposure.
What must keep working?
Identify the operations that depend on accounts, email, devices, applications, connectivity and data. A small application used by Finance may matter more than a large system with an easy manual fallback.
Where is responsibility unclear?
Ask who owns configuration, staff changes, updates, monitoring decisions and recovery. Buying a licence does not establish who checks coverage or who is authorised to respond.
What evidence would give you confidence?
Useful evidence includes an agreed asset scope, control status, unresolved exceptions and a tested recovery record. A dashboard screenshot on its own cannot establish business readiness.
Connect the controls that often get separated.
| Security area | Questions your scope should answer | Evidence to request |
|---|---|---|
| Identity and access | Who has access? Is MFA appropriate and enforced? How are administrator and supplier privileges approved and removed? | Account coverage, privileged-role review and joiner/leaver records. |
| Email and Microsoft 365 | How are phishing, mailbox forwarding and account changes handled? Which protections are licensed and configured? | Policy coverage, exceptions and a defined suspicious-message process. |
| Endpoints and configuration | Which devices are protected, supported, updated and encrypted where appropriate? Who resolves unhealthy or missing agents? | Device inventory, protection health, patch status and exception owners. |
| Networks and remote access | Who owns firewall rules, guest access, remote entry points and configuration review? | Documented boundaries, authorised administration and review responsibilities. |
| Cloud and business applications | Who controls access, configuration, provider responsibilities and sensitive data? | Application ownership, access review and an agreed data-handling model. |
| Vulnerability exposure | How are unsupported software and exposed services identified and prioritised? | A risk-ranked action list with ownership, dates and validation. |
| Logging and alerts | Which events are collected? Who reviews them, during which hours, and what can they do? | An explicit monitoring and escalation schedule, with exclusions. |
| Backup and ransomware readiness | Can critical information be restored? Are recovery copies and access suitably separated? | Recovery priorities, restore-test results and unresolved recovery gaps. |
| People, suppliers and governance | How are risky requests reported? Who approves exceptions and manages third-party exposure? | Usable procedures, supplier boundaries and recorded risk decisions. |
| Incident preparedness and continuity | Who makes the first decisions if systems or data become unavailable? | Contact paths, authority to act and a practised continuity plan. |
These are areas to review and scope. They are not a blanket promise that every specialist service is included. A proposal must distinguish Foxbyte delivery, customer responsibilities, third-party work and any excluded activity.
Go deeper where the decision needs detail.
Microsoft 365 & Email Security
Review identity, administrator access, email protections and account lifecycle. Connect the subscription, the actual configuration and the people who operate it.
Explore Microsoft 365 & Email SecurityEndpoint Protection
Understand device coverage, configuration, updates, alert ownership and exception handling. Keep the endpoint service connected to access and recovery responsibilities.
Explore Endpoint ProtectionTurn a review into an accountable plan.
Illustrative process — agree the actual scope before implementation.
- Agree the scopeIdentify assets, access boundaries and permitted assessment activity.
- Establish the baselineReview the agreed controls and record evidence and gaps.
- Prioritise changesConnect the risk, the action, the owner and the acceptance check.
- Operate and reviewConfirm responsibilities, exceptions, reporting and review points.
A security review should support decisions. For each finding, ask what business operation is exposed, what needs to change, who can authorise it and how improvement will be checked. A list of tools without responsibilities leaves the operating problem unresolved.
Know what the agreement actually covers.
| Ask before appointing a provider | Why it matters |
|---|---|
| Which systems and users are included? | Unlisted devices, tenants, locations or applications may remain outside the agreed service. |
| What are the service hours and escalation rules? | A product that generates alerts continuously is not the same as a staffed 24/7 response service. |
| Who may isolate a device, disable access or change a rule? | Authority should be agreed before an incident or disruptive control change. |
| What does the customer still need to do? | Access approval, procurement, staff communication and business risk decisions may remain with the customer. |
| What is excluded or separately quoted? | Penetration testing, specialist incident response, forensics and regulated assurance must not be assumed. |
| What reporting and handover will be provided? | A usable record should show coverage, completed actions, exceptions and next decisions. |
Boundaries are part of the service.
This page does not advertise a 24/7 SOC, MDR, penetration testing, emergency incident response, forensic capability or a compliance certification. Where specialist work is needed, confirm the delivery arrangement and authority before engaging.
Know what useful reporting looks like.
This is an illustrative reporting structure, not a report of Foxbyte customer outcomes. Agree which of these records are included, how often they are reviewed and who needs to act.
- Coverage: the current user, device, tenant and service list compared with the agreed scope.
- Changes: completed configuration or remediation work, its approval and the verification performed.
- Exceptions: unsupported, unreachable or out-of-scope items, with an owner and an agreed next action.
- Business decisions: unresolved access, supplier, continuity or investment choices that require the customer’s authority.
A useful review explains what is covered, what remains uncertain and what happens next. A dashboard alone does not establish that somebody is responsible for acting.
Before comparing proposals, review what a cybersecurity assessment should deliver and use the managed security provider comparison checklist.
Prepare for a security scoping conversation.
- List the business-critical applications and data.
- Estimate users, devices, locations and cloud tenants.
- Describe the concern: access, phishing, device health, recovery or unclear ownership.
- Identify the person who can authorise access and changes.
- Bring existing scope documents or high-level findings where you are authorised to share them.
Do not put credentials, confidential logs or suspected malicious attachments into a public enquiry. For an active incident, follow your existing incident plan and contact your authorised responder; this page does not establish emergency response availability.
Use the Microsoft 365 buyer checklist Review backup and ransomware readinessQuestions about managed cybersecurity.
Is this only antivirus and Microsoft 365?
No. The discussion should connect business risk, identity, devices, networks, applications, data, people and recovery. The exact delivery scope and each party’s responsibilities are agreed before work starts.
Can you guarantee that we will not be attacked?
No. Security controls reduce and manage risk; they do not remove every threat. Look for transparent scope, evidence of control operation and clear residual risks rather than prevention guarantees.
Does a security review certify compliance?
Not by itself. A technical review and a formal legal, regulatory or certification assessment have different purposes. Confirm the required assurance, qualified provider and evidence before relying on a compliance claim.
How is a managed-security price determined?
The relevant environment, scope, licences, operating responsibilities, service hours and reporting requirements affect the proposal. Foxbyte does not publish an unassessed universal security price here.
Sources and further reading
Start with the gap you need to understand.
Describe the business concern and the environment at a high level. The next step is a scoped conversation with clear access and responsibility boundaries.
Foxbyte Insights
Prepare for the decision.
Cybersecurity
Managed cybersecurity versus antivirus: compare the responsibility
Antivirus is a tool or capability. Managed cybersecurity is an agreed operating service: who configures protections, reviews information, responds within scope and reports what still needs attention. Buying a license does not answer those responsibility questions.
Foxbyte InsightsPublished Updated
Read the guide: Managed cybersecurity versus antivirus: compare the responsibilityCybersecurity
Build a cybersecurity budget around the gaps you can explain
Build a cybersecurity budget from known gaps and the people needed to operate the controls. Buying several tools without ownership can leave the same business risks unresolved.
Foxbyte InsightsPublished Updated
Read the guide: Build a cybersecurity budget around the gaps you can explainCybersecurity
Write a first-hour cyber incident contact plan before you need it
Prepare the first-hour contact and authority plan before an incident. The goal is to know who can decide, how they can be reached and which qualified help is available when normal systems may be unreliable.
Foxbyte InsightsPublished Updated
Read the guide: Write a first-hour cyber incident contact plan before you need it