Industry

Public Sector & Infrastructure

Systems the public has no alternative to.

Public bodies and infrastructure operators run services that citizens cannot choose to stop using, which changes both the impact of an incident and the standard of accountability afterwards. Gryffin supports compliance programmes, resilience planning, incident response and the protection of citizen data at scale.

Industry Challenges

What makes this industry different.

Legacy estates with long replacement cycles

Systems remain in service well past their design life, and replacement is a budget cycle rather than a project.

Public accountability after an incident

Response is examined publicly and retrospectively, so evidence, timeline and decision records matter as much as containment.

Citizen data at population scale

Data protection obligations apply to records for people who never chose to share them with an alternative provider.

Procurement cycles that outlast the threat

Controls procured on a multi-year cycle have to remain effective against adversaries who change monthly.

Public sector engagements are scoped around the applicable national framework, data classification scheme and any critical infrastructure designation, which vary considerably by jurisdiction and industry.

Services

Services Most Used Here

Someone is watching at 3am. And they answer.

Attacks do not arrive during office hours; they arrive when nobody is looking. A managed SOC gives you continuous coverage without staffing three shifts - but only if the detection content is built for your environment and the escalation arrives with an investigation already attached. Gryffin builds the detection, runs the monitoring, and escalates with a recommendation rather than a raw alert.

Services Description

What the engagement covers.

Log source onboarding and normalisation

Identifying the telemetry that matters, onboarding it, and normalising it so correlation is possible across endpoint, identity, network, cloud and application sources.

Detection engineering

Detection content written and tuned for your environment and industry, mapped to MITRE ATT&CK, with coverage gaps documented rather than glossed over.

24x7 monitoring and triage

Continuous analyst coverage with alert triage, enrichment and investigation before anything reaches you.

Escalation and response support

Agreed escalation paths, severity definitions and response-time commitments, with pre-authorised containment actions where you want them.

Threat hunting

Scheduled hypothesis-driven hunts looking for what the detections would have missed, feeding new content back into the platform.

Reporting and coverage review

Monthly operational reporting and quarterly coverage review against ATT&CK, with a roadmap for closing remaining gaps.

What you receive

Onboarding plan and log source inventory
Detection content library mapped to MITRE ATT&CK
Documented escalation matrix, severity definitions and response SLAs
24x7 monitoring with named analyst escalation contacts
Monthly operational report and quarterly coverage review
Incident reports with timeline, impact and recommended control changes

Gryffin Global Capabilities

Detection built for you, not shipped as defaults

Default SIEM content produces volume, not value. Our engineers build and tune detections against your log sources and business processes, and we measure the true-positive rate rather than the alert count.

Coverage you can see

Detection coverage is mapped against MITRE ATT&CK, so you know which techniques you would catch, which you would miss, and what closing each gap costs. Nobody has to take the coverage claim on trust.

Escalations that arrive with an answer

An alert reaches you triaged, enriched and with a recommended action. Where you have pre-authorised containment, the action has already been taken and you are told what and why.

Bring your own platform, or ours

We operate on Microsoft Sentinel, Splunk, QRadar, Elastic and others. If you have already invested in a platform, the engagement starts by making it work rather than replacing it.

Use Cases

Illustrative. Scenarios drawn from common engagement patterns.

A SIEM nobody reads any more

Situation: A retailer's platform generated thousands of daily alerts against a two-person team, so alerts went unreviewed.
What Gryffin does: Log source review, detection content rebuilt against ATT&CK, consolidation and suppression tuning, transition to 24x7 monitored service.
Outcome: Alert volume cut by an order of magnitude with a true-positive rate high enough that alerts get worked again.

No out-of-hours coverage at all

Situation: A manufacturer discovered an overnight ransomware detonation when the first shift arrived.
What Gryffin does: 24x7 monitoring with automated containment for encryption behaviour, plus a retained response capability and tested recovery runbooks.
Outcome: A later attempt was detected and contained within minutes, with no production impact.

A security team spending its time on triage

Situation: An internal team of skilled engineers was consumed by first-line alert triage and had no time for improvement work.
What Gryffin does: Tier 1 and Tier 2 triage moved to the managed service, with the internal team retained for escalation and engineering.
Outcome: Internal capacity returned to detection engineering and hardening, with response times improving at the same time.

The first hours decide what you can prove.

When an incident becomes a notification, a claim or a case, the standard changes: what you believe happened stops mattering and what you can evidence starts to. Gryffin's DFIR practice combines containment speed with forensic rigour - acquiring evidence properly from the first hour, reconstructing what actually occurred, and reporting it to a standard that survives challenge.

Services Description

What the engagement covers.

Emergency response and containment

Rapid engagement to stop active intrusion - isolation, credential revocation and access closure - executed so that evidence is preserved rather than destroyed.

Forensic acquisition

Sound acquisition across endpoints, servers, mobile devices, cloud control planes and SaaS audit logs, under documented chain of custody.

Timeline reconstruction

Establishing initial access, dwell time, lateral movement, privilege use and actions on objectives from the evidence.

Data exposure scoping

Determining what data was actually accessed rather than merely accessible - the distinction on which most notification decisions turn.

Malware and artefact analysis

Analysis of tooling, persistence and command-and-control infrastructure, producing indicators for detection and hunting.

Reporting and expert support

Findings documented to evidentiary standards, with expert explanation and testimony support for regulatory, insurance or legal proceedings.

What you receive

Containment actions log with timestamps and authority
Forensic acquisition record with hashes and chain of custody
Incident timeline with supporting evidence references
Data exposure assessment supporting notification decisions
Indicators of compromise for detection and hunting
Formal report to evidentiary standard, plus an executive summary
Post-incident control recommendations tracked to closure

Gryffin Global Capabilities

Containment without destroying evidence

Rebuilding a compromised host is the fastest way to lose the answer. Our responders contain and preserve simultaneously, because the notification question arrives a week later and needs evidence.

Cloud and SaaS acquisition, not just disks

Investigations now run through cloud control planes, identity logs and collaboration platforms. Our acquisition capability covers them alongside traditional endpoints and mobile devices.

Structured with your counsel

Scope, privilege, disclosure obligations and reporting standard are agreed with your legal advisors before collection begins.

Confidence stated honestly

Reports separate what the evidence establishes from what it suggests. Overstated forensic findings collapse under cross-examination, and we will not write them.

Use Cases

Illustrative. Scenarios drawn from common engagement patterns.

A notification clock already running

Situation: A company confirmed unauthorised access and faced regulatory deadlines without knowing what data had been reached.
What Gryffin does: Rapid acquisition across affected systems, timeline reconstruction, and scoping of data actually accessed versus accessible.
Outcome: A defensible notification position established inside the deadline, based on evidence rather than assumption.

Business email compromise with money already moved

Situation: A finance team discovered fraudulent payment instructions had been actioned after a mailbox compromise.
What Gryffin does: Mailbox and identity log forensics, rule and delegation analysis, scope of access established, and evidence prepared for the bank and insurer.
Outcome: The compromise scoped and documented, supporting both the recovery attempt and the insurance claim.

An incident that looked contained but was not

Situation: A company rebuilt an infected host and considered the matter closed, then saw the same activity return weeks later.
What Gryffin does: Full forensic investigation across the estate, uncovering persistence on additional systems and the original access route.
Outcome: Complete eradication, with the initial access vector closed and detection built for the techniques used.

Attack it properly, or find out the hard way.

A penetration test is only worth what its findings are worth. Automated scanning tells you which software versions are old; it does not tell you that a low-privilege user can read another customer's records by changing one identifier. Gryffin's testing combines tooling for coverage with manual, business-logic-aware testing for the findings that actually matter - then reports them in a form your engineers can act on the same week.

Services Description

What the engagement covers.

External infrastructure testing

Internet-facing assets, exposed services, misconfiguration, weak transport security and credential exposure - assessed the way an unauthenticated attacker would approach them.

Internal network testing

Assumed-breach testing from inside the network: privilege escalation, lateral movement, Active Directory attack paths, credential harvesting and access to crown-jewel systems.

Web application testing

Manual testing against the OWASP ASVS covering authorisation, session handling, injection, business-logic abuse and multi-tenant isolation, on top of automated coverage.

Mobile application testing

iOS and Android assessment across client-side storage, transport security, platform misuse, anti-tampering, and the backend APIs the app depends on, aligned to OWASP MASVS.

API testing

REST, GraphQL and service-to-service interfaces assessed against the OWASP API Top 10 - broken object-level authorisation, excessive data exposure, rate-limit bypass, token and key handling.

Cloud configuration review

Authenticated review of cloud accounts covering identity policy, network exposure, storage permissions, logging and key management.

What you receive

Executive summary written for a non-technical reader, with an overall risk position
Technical findings with reproduction steps, evidence and affected components
Risk rating by exploitability and business impact, not scanner severity alone
Specific, implementable remediation guidance per finding
Remediation walkthrough session with your engineering team
Free retest of remediated findings and an updated clean report
Attestation letter suitable for customers, auditors and insurers

Gryffin Global Capabilities

Certified testers, recognised methodology

Testing follows PTES, OWASP ASVS, MASVS and the API Top 10, mapped to MITRE ATT&CK, delivered by testers holding OSCP, CREST and equivalent credentials - so the report holds up in customer security reviews and regulatory scrutiny.

Manual depth where it counts

Roughly the majority of the findings we consider high severity come from manual testing of authorisation and business logic. Those are the flaws no scanner reports and no attacker ignores.

Retest included, not sold separately

Remediation verification is part of the engagement. You get an updated report showing findings closed, which is usually what the customer or auditor actually asked for.

Production-safe rules of engagement

Scope, timing, rate limits, prohibited actions and abort conditions are agreed and signed before testing begins, with a named contact reachable throughout.

Use Cases

Illustrative. Scenarios drawn from common engagement patterns.

An enterprise deal blocked on a security questionnaire

Situation: A software vendor's largest prospect required an independent penetration test report dated within twelve months before contract.
What Gryffin does: Scoped external and application test with an executive summary written for the buyer's security team, plus retest after remediation.
Outcome: Report accepted by the buyer, high-severity findings closed in under three weeks, deal signed.

A payments feature about to go live

Situation: A fintech was releasing a new money-movement flow with authorisation logic that had never been independently reviewed.
What Gryffin does: Targeted application and API testing focused on authorisation and business logic, supported by source code review of the transaction path.
Outcome: Two flaws found that would have allowed transaction manipulation, both remediated before release.

An annual test that keeps finding the same things

Situation: A group had tested annually for years and kept receiving near-identical reports, suggesting remediation was not reaching root cause.
What Gryffin does: Testing plus a root-cause review of recurring finding classes, feeding into secure development standards and pipeline scanning.
Outcome: Repeat finding categories dropped away over the following two cycles as the underlying practices changed.

Privacy engineered in, not written on.

Privacy compliance fails when it stops at policy. The obligations that create real exposure - knowing what personal data you hold, being able to delete it, proving consent, notifying a breach inside the deadline - are engineering problems in a legal wrapper. Gryffin handles both sides: the assessment and documentation regulators expect, and the technical work that makes the commitments true.

Services Description

What the engagement covers.

Data discovery and mapping

Identifying personal data across systems, including the copies in analytics, backups, spreadsheets and third-party platforms, and recording it in a maintainable Record of Processing Activities.

Lawful basis and consent design

Establishing and documenting a lawful basis for each processing activity, and designing consent capture, withdrawal and record-keeping that stands up to challenge.

Data subject rights operations

Building the workflow that answers access, correction, erasure and portability requests inside the statutory window - including the technical means to find and delete data across systems.

Cross-border transfer controls

Transfer mapping, mechanism selection, transfer impact assessment and the supplementary technical measures that make a transfer defensible.

DPIAs and privacy by design

Assessment of high-risk processing, and privacy requirements introduced into the design of new systems rather than reviewed after build.

Breach readiness and notification

Detection, assessment, classification and notification workflow built to the applicable deadline, with the decision criteria documented in advance.

What you receive

Data inventory and Record of Processing Activities
Lawful basis register and consent design specification
Data subject request workflow with technical fulfilment procedure
Transfer register, mechanism selection and transfer impact assessments
DPIA templates and completed assessments for high-risk processing
Breach response and notification playbook with decision criteria
Privacy notices, retention schedule and processor agreement templates

Gryffin Global Capabilities

Discovery that includes the copies

Personal data multiplies into analytics stores, backups, exports and third-party tools. Our mapping covers where it actually ended up, because an erasure commitment you cannot fulfil is worse than none.

Rights requests as an engineering workflow

We build the technical means to locate, export and delete data across systems, not just the policy that promises it. That is the difference between meeting the deadline and explaining why you did not.

Both regimes, one programme

Where you fall under GDPR and India's DPDP framework, we design a single control set that satisfies both and note where the regimes genuinely diverge.

Breach notification rehearsed against the clock

The notification window starts at awareness, not at certainty. We build the decision criteria and rehearse them, so the clock is not spent deciding who decides.

Use Cases

Illustrative. Scenarios drawn from common engagement patterns.

An erasure request that could not be fulfilled

Situation: A consumer business received a deletion request and discovered personal data existed in systems nobody had inventoried.
What Gryffin does: Full data discovery, RoPA construction, and an erasure workflow with technical fulfilment across primary, analytics and backup stores.
Outcome: Requests fulfilled inside the statutory window, with a documented procedure for the ones that follow.

Cross-border processing with no transfer basis

Situation: Support and engineering teams in another jurisdiction accessed EU personal data under no documented transfer mechanism.
What Gryffin does: Transfer mapping, mechanism selection, transfer impact assessment and supplementary technical measures including access controls and pseudonymisation.
Outcome: A documented, defensible transfer position without restructuring the delivery model.

A new product feature with unassessed privacy risk

Situation: A team was about to ship behavioural profiling with no assessment of the risk to individuals.
What Gryffin does: DPIA on the processing, design changes to reduce data collected and retention held, and privacy requirements added to the delivery process.
Outcome: Feature shipped with documented assessment and materially less personal data in play.

Nothing crosses without being asked who it is.

The legitimate flows through untouched and compliant; the malicious never makes it past the wall. This pillar covers the controls that decide what enters your network, what moves inside it, and who is allowed to reach what.

Services Description

9 services within this pillar.

Next-Generation Firewall & Perimeter Defence

Design and policy engineering for next-generation firewalls with application awareness, inspection and threat prevention - including the rulebase cleanup that most inherited estates badly need.

Intrusion Detection & Prevention (IDS / IPS)

Tuned detection and inline prevention across north-south and east-west traffic, calibrated to your environment so alerts remain worth reading.

Network Access Control & Segmentation

Device posture checks, role-based network admission and segmentation that contains an intrusion to the zone it started in rather than the estate it wanted.

Secure Web Gateway & DNS Security

Outbound control over web and DNS traffic - category and content policy, encrypted traffic inspection, and blocking of command-and-control callbacks.

DDoS Protection & Traffic Resilience

Volumetric and application-layer mitigation architecture with tested failover, so availability holds under deliberate pressure.

Zero Trust Network Access (ZTNA)

Application-level access that replaces flat VPN trust - every request authenticated, authorised and continuously evaluated against device and user context.

Identity & Access Governance

Joiner-mover-leaver automation, privileged access management, entitlement review and least-privilege enforcement across on-premises and cloud identity stores.

Multi-Factor & Adaptive Authentication

Phishing-resistant authentication rolled out with a migration path users will actually accept, with risk-based step-up for sensitive actions.

Secure Connectivity (VPN, SD-WAN)

Encrypted site-to-site and remote connectivity with resilient routing, integrated inspection and consistent policy across branch, data centre and cloud.

Gryffin Global Capabilities

Vendor-independent design, multi-vendor delivery

We design to the requirement and then deploy on the platform that fits - including the one you already own. Our engineers are certified across the major firewall, NAC and identity platforms rather than tied to a single OEM.

Rulebase archaeology

Inherited firewall estates accumulate thousands of rules nobody dares touch. We analyse actual traffic against policy, retire what is dead, tighten what is over-permissive, and document what remains.

Zero Trust delivered in stages people accept

ZTNA rollouts fail on adoption, not technology. We sequence migration by application and user group, run VPN and ZTNA in parallel through cutover, and keep a rollback path open at every stage.

Identity treated as the real perimeter

Access governance, privileged access and phishing-resistant authentication are designed as one programme, because an attacker with valid credentials walks past every network control you own.

Use Cases

Illustrative. Scenarios drawn from common engagement patterns.

Flat network, one breach away from everything

Situation: A logistics business ran a largely flat internal network where a single compromised workstation could reach production systems and the finance environment alike.
What Gryffin does: Traffic analysis, segmentation design by business function, phased NAC rollout with device posture checks, and east-west inspection between zones.
Outcome: Blast radius reduced to a single zone, with segmentation validated by a follow-up internal penetration test.

VPN cannot carry a permanently hybrid workforce

Situation: Concentrator capacity, split-tunnel exceptions and broad internal access had turned remote access into both a performance problem and a security one.
What Gryffin does: ZTNA design with per-application access policy, device posture enforcement, phased migration by department, and decommissioning of legacy VPN access once traffic had moved.
Outcome: Full remote access without network-level trust, and an access model where leavers lose everything the moment identity is disabled.

Contractors and third parties with more access than anyone can justify

Situation: Years of ad-hoc vendor access had left standing accounts with broad privilege and no review cycle.
What Gryffin does: Identity governance rollout with entitlement review, privileged access vaulting for third-party accounts, time-bound access, and joiner-mover-leaver automation.
Outcome: Standing third-party privilege removed, with every remaining access grant owned, expiring and reviewed.

Security that stays current after go-live.

Controls decay, standards revise, and certifications expire. This pillar keeps the programme alive between projects - running the systems, maintaining the evidence, and carrying certifications through their next cycle.

Services Description

6 services within this pillar.

ISMS & ITSMS Lifecycle Management

Ongoing operation of your management systems - risk register upkeep, policy review cycles, internal audit programme and management review - so the system is live rather than reconstructed before each audit.

Standards Maintenance & Recertification

Continuous maintenance and surveillance-audit support across ISO 27001, 27017, 27018, 20000, 22301 and 27799, including gap remediation ahead of each cycle.

Managed Detection & Response Retainer

Continuous monitoring with committed response, delivered as a retained service including a pre-agreed incident response capability that activates without a procurement cycle.

Security Device & Policy Management

Day-to-day operation of firewalls, gateways, endpoint and identity platforms - change management, rule hygiene, patching, version currency and health monitoring.

Vulnerability Management as a Service

Scheduled scanning, validation, risk-based prioritisation and remediation tracking through to closure, reported against agreed service levels.

Quarterly Assurance Review & Reporting

A regular readout on control effectiveness, incident trends, compliance status and residual risk, written for the board as well as the security team.

Gryffin Global Capabilities

Certifications kept alive between audits

Risk registers, policy reviews, internal audit programmes and management reviews run on a maintained schedule, so surveillance audits are a checkpoint rather than a fire drill.

One provider across the whole estate

Because Gryffin designs, deploys and operates, the team maintaining your controls is the team that built them. Nothing is lost at the handover between project and operations.

Service levels that are measured and reported

Response times, patch currency, rule hygiene, vulnerability closure and detection coverage are reported against agreed targets every quarter, with misses explained rather than averaged away.

Written for the board as well as the security team

Quarterly reporting covers control effectiveness, incident trends, compliance status and residual risk in language leadership can act on, alongside the operational detail your engineers need.

Use Cases

Illustrative. Scenarios drawn from common engagement patterns.

A certification maintained by one person who has resigned

Situation: An ISO 27001 certified organisation lost the individual who held the entire management system in their head, weeks before a surveillance audit.
What Gryffin does: Emergency ISMS assessment, reconstruction of records and evidence, internal audit completion, and transition to a maintained managed service.
Outcome: Certification retained at surveillance, with the management system no longer dependent on a single person.

Security tooling running on last year's configuration

Situation: Firewalls, endpoint agents and gateways had drifted out of version currency with rules nobody had reviewed in two years.
What Gryffin does: Managed device service covering patch and version currency, rule hygiene, change management and health monitoring, with a documented baseline.
Outcome: Platforms brought current and held there, with configuration drift caught in weeks rather than years.

Vulnerability scanning that produces reports nobody closes

Situation: Scanning ran monthly and produced findings, but with no ownership or tracking the same vulnerabilities appeared cycle after cycle.
What Gryffin does: Managed vulnerability service with validation, risk-based prioritisation, owner assignment, remediation tracking to closure, and SLA reporting.
Outcome: Critical findings closed within agreed windows, and repeat findings falling away as root causes were addressed.

Questions

Frequently asked

Talk to us about Public Sector & Infrastructure

Tell us the obligation, the incident or the deadline driving the conversation - the first conversation is a scoping call, not a pitch.

We respond within 12 hours

Public Sector & Infrastructure

Systems the public has no alternative to.

Public Sector & Infrastructure

What makes this industry different.

Services Most Used Here

Services Description

Gryffin Global Capabilities

Use Cases

Services Description

Gryffin Global Capabilities

Use Cases

Services Description

Gryffin Global Capabilities

Use Cases

Services Description

Gryffin Global Capabilities

Use Cases

Services Description

Gryffin Global Capabilities

Use Cases

Services Description

Gryffin Global Capabilities

Use Cases

Frequently asked

How quickly can Gryffin start an engagement?

Do you work with our existing security tooling?

What is the difference between a penetration test and a red team exercise?

Can you help us achieve certification, or only prepare for it?

Talk to us about Public Sector & Infrastructure

Public Sector & Infrastructure

What makes this industry different.

Services Most Used Here

Services Description

Gryffin Global Capabilities

Use Cases

Services Description

Gryffin Global Capabilities

Use Cases

Services Description

Gryffin Global Capabilities

Use Cases

Services Description

Gryffin Global Capabilities

Use Cases

Services Description

Gryffin Global Capabilities

Use Cases

Services Description

Gryffin Global Capabilities

Use Cases

Frequently asked

How quickly can Gryffin start an engagement?

Do you work with our existing security tooling?

What is the difference between a penetration test and a red team exercise?

Can you help us achieve certification, or only prepare for it?

Talk to us about Public Sector & Infrastructure