Identity is the
new perimeter.

Identity security governs who can sign in, from where, on what device, and with what privileges. It is the control set that decides the outcome of most modern attacks. It is for organisations still treating the network as the boundary while their data sits in the cloud.

It means signing in needs something you know, your password, plus something you have, usually your phone. It matters because passwords leak constantly, from breaches at other services and from convincing fake login pages, and multi-factor turns a leaked password from a crisis into a nuisance. It is the single highest-value security control available to a small business, and for most organisations it is already included in what you pay Microsoft or Google.

Some forms, yes. Codes by text message can be intercepted, and there are phishing kits that sit in the middle and capture a code in real time. It is still enormously better than nothing. Where it matters most, use an authenticator app with number matching or a hardware key rather than text messages, and pair it with conditional access so an unexpected sign-in gets challenged even with a valid code.

Yes, and the annoyance is usually a sign it has been configured bluntly. Prompting on every sign-in from a known device in the office is unnecessary friction. Configured properly, people are prompted when the risk signals warrant it and left alone otherwise, which is both more secure and considerably less irritating than a fixed daily prompt.

Usually nothing, right up until it matters. The realistic risks are a departing salesperson taking the customer list, an account nobody is watching being used as a quiet way back in, and a licence you keep paying for. The fix is not vigilance, it is process: access removal tied to the payroll exit so it happens whether or not anyone remembers.

Usually yes, and not mainly for convenience. One identity across your applications means one place to enforce multi-factor, one place to see who has access to what, and one action to remove someone completely. Without it, offboarding is a list of systems somebody has to work through by hand, and that list is never complete.

We quote after scoping rather than before. Anyone pricing this work without looking at your environment is guessing, and the guess is rarely in your favour. Scoping itself is quick, and we tell you what it costs before we start it.

A first conversation takes about half an hour and costs nothing. Scoping is usually a week or two of our time depending on the size of the environment, and we agree the delivery dates with you before anything is booked in.

Yes, and it is common. We are happy to work as an extra pair of hands under your internal team, or alongside an incumbent provider on a defined piece of work. We will set out in writing where the responsibilities split, so nothing falls between us.

No. This can be delivered as a standalone piece of work for an organisation we have never worked with before, or folded into a managed agreement if you already have one with us. Plenty of clients use us for one thing and keep everything else where it is.

Our team is based in Auckland and we attend sites across the wider region. Most of this work is delivered remotely, so we support organisations throughout New Zealand, and we will say up front where being on site genuinely matters.

Named people, not a queue. You get a lead who knows your environment and stays with it, which is the difference between explaining your business once and explaining it every time you make contact.

You keep the documentation regardless, and anything registered in your name stays in your name. Whether we stay involved is your call. Some clients take it in house from there, others move it onto an ongoing agreement with us. We would rather you left cleanly than stayed because leaving was difficult.