What is your real cyber risk?
Independent, technical and executive assessment, vendor-neutral. From assessment to response, we turn technical risk into business decisions.
Continuous monitoring at the lowest price on the market
Detection, investigation and response around the clock, with SLA by severity and cost broken down by component.
Explore the SOC Featured · ISO 27001 and ISO 22301 CertificationFrom assessment to certificate
A complete program led by an ISO 27001 Lead Auditor, with the same team all the way to the certification audit.
Explore the programA continuous cycle, not a one-off project.
We start from the business, critical processes and assets, not a generic checklist. Each stage feeds the next, with technical evidence and board-level language.
Real risk
NIST/CIS maturity and financial quantification.
Surface
Vulnerabilities, hardening and identity.
Real attack
Pentest and purple team with evidence.
SOC & Threat Intel
24x7, dark web and brand.
Incidents
Containment, forensics and recovery.
Pick the question. See what we deliver.
What is your real cyber risk?
Independent, technical and executive assessment, vendor-neutral.
- Cyber and operational resilience risk assessment and quantificationReal exposure from understanding the business, by critical process and asset, not a generic checklist.
- Maturity assessment (NIST CSF 2.0 or CIS Controls)Current score by function, market benchmark and AS-IS vs. target radar.
- Financial quantification of cyber exposureTechnical risk translated into loss scenarios and value at risk, board and committee language.
- Prioritized executive roadmapInitiatives sequenced by risk, cost and timeline, ready to become budget and targets.
You've been attacked. Now what?
Containment, safe recovery and root cause.
- Cyber incident response (IR)Containment, eradication and recovery with playbooks, chain of custody and crisis command.
- Post-attack operational recoveryRestoration prioritized by criticality, integrity validation and safe return to production.
- Digital forensics and root cause analysisEvidence, attack timeline, initial vector and extent of compromise.
- Response plan and ransomware readinessScenario playbooks, communication matrix, activation criteria and legal notification (LGPD/ANPD).
- Cyber crisis tabletop exerciseSimulation with senior leadership, decision time, response gaps and readiness score.
How many doors are you leaving open?
Fewer attack paths, less possible impact.
- Risk-based vulnerability managementPrioritized by real exploitability (CVSS + EPSS + KEV), not by finding volume.
- External attack surface management (ASM)OSINT mapping of exposed assets, shadow IT, legacy services and unnecessary ports.
- Hardening and configuration baselinesCIS Benchmarks across endpoints, servers, cloud and identity, continuously verified.
- Identity and privileged access protectionPhishing-resistant MFA, least privilege, access reviews and orphan account removal.
- Ransomware resilience and backup security3-2-1-1-0 rule, immutable copies, segmentation and periodic restore tests.
Can your environment withstand a real attack?
Controlled exploitation and measured detection, with technical evidence.
- External pentestOSINT reconnaissance of the perimeter, public apps, VPN and email, controlled exploitation from the internet.
- Internal pentestLateral movement, privilege escalation and paths to Domain Admin and critical data.
- Application, API and cloud pentestOWASP Top 10 / ASVS, business logic, authentication, authorization and cloud configuration.
- Purple Team exerciseMITRE ATT&CK TTPs run alongside the blue team, measures real detection, alerting and response.
- Retest and fix validationRetest of remediated vulnerabilities with closure evidence and residual risk.
Who watches your environment at 3 a.m.?
Firewall, antivirus and Active Directory record everything, but nobody reads those records in real time. The NLC SOC turns logs into decisions around the clock, at the lowest cost on the market.
- DetectCollection and correlation of firewall, Active Directory, endpoints, servers, Microsoft 365 and databases, with use cases mapped to MITRE ATT&CK.
- InvestigateThree-tier triage (L1, L2 and L3), asset and identity context, false-positive removal and root cause with preserved evidence.
- RespondAutomated playbooks that isolate the endpoint and block the indicator at the firewall, always within the approval policy agreed with you.
- Hunt threatsMonthly hypothesis-driven threat hunting, leaked credential monitoring and a 12-month retroactive sweep whenever a new indicator appears.
- Be accountableContractual SLA by severity, monthly MTTD and MTTR, ATT&CK coverage and a results meeting with leadership.
What has already leaked about your company?
Continuous monitoring of brand, data and executives.
- OSINT reconnaissance and continuous monitoringDomains, DNS, certificates, IPs, metadata, profiles and targeted executives under watch.
- Exposed credential detectionLeaks, combolists and infostealer logs with validation and immediate containment.
- Dark web, forums and TelegramMentions, initial access offers, data for sale and ransomware activity.
- Brand and impersonationLookalike domains, fake profiles, apps and phishing campaigns using your identity.
- Triage, rating and alertsFindings triaged and rated, with immediate alerts and a monthly executive report.
Would your team spot a scam before clicking?
Most attacks start with a person: a convincing email, a phone call, a link. We turn employees into the first line of defense.
- Human risk assessmentMost exposed areas and profiles, security culture maturity and a behavioral baseline.
- Awareness programAnnual track by audience (leadership, critical areas and all employees), with short content and continuous reinforcement.
- Phishing simulation campaignsEmail, SMS and QR code simulations with real scenarios from your industry, progressive difficulty and guidance at the moment of the click.
- Awareness platformTraining, simulations, learning paths and certificates in one place, showing the progress of each area and each employee.
- Board-level indicatorsClick rate, report rate, time to report and reduction of human risk over time.
ISO 27001 is required. Can you prove it?
A complete Certification Program, from assessment to certificate, led by an ISO 27001 Lead Auditor.
- ISO/IEC 27001:2022 gap assessmentConformance with clauses 4–10 and the 93 Annex A controls, with a closure plan.
- ISMS implementation or reviewContext, scope, policy, roles, documentation, SoA and alignment with business objectives.
- InfoSec risk management (ISO 27005)Methodology, asset inventory, analysis, acceptance criteria and treatment plans.
- Internal audit and certification readinessInternal audit, management review and support through stages 1 and 2.
- Sustainment and continual improvementKPIs, nonconformities and readiness for surveillance and recertification.
Your environment watched at all times, at the lowest price on the market.
The problem is rarely a lack of tools. It is a lack of someone watching. An attacker typically stays inside a company for about 10 days before being noticed, and firewall and antivirus records are often erased before then. Without 24-hour monitoring, two thirds of the week go uncovered.
How it works, from event to closure
Ingestion
Events normalized and enriched with asset and identity context.
Correlation
Use cases mapped to MITRE ATT&CK raise the alert.
L1 triage
Analyst validates, discards false positives and opens a ticket.
L2/L3 investigation
Scope, timeline and root cause.
Response
Automated playbook or guided containment, with notice to you.
Closure
Evidence, lessons learned and rule tuning.
Three ways to engage
You choose how much of the environment to monitor and how long to keep it. Sizing is transparent: event volume per source, gigabytes per day and retention, so you pay for what you actually use.
Essential SOC
The sources that detect the most attacks, with 12 months of history.
- Firewall, Active Directory, antivirus/EDR alerts and Microsoft 365
- 45 use cases at go-live and 4 new ones per quarter
- 10 automated response playbooks
- L1, L2 and L3 operations 24x7x365
Extended SOC
Everything in Essential plus the view that reveals an attacker moving inside the network.
- Endpoint process telemetry
- In-depth Windows and Linux servers
- Privileged access trail on Oracle and SQL Server
- Threat hunting with a formal campaign each quarter
Full SOC
Full environment collection, industry-specific use cases and integrated response.
- Full collection from every source
- Industry use cases and additional playbooks
- Integration with NLC Incident Response and forensics
- Compliance reports for ISO 27001 and LGPD
Scale up at any time in capacity blocks, effective the following month, with no new contract. Shortening the searchable history window also frees capacity at no extra cost.
Why it is the lowest price on the market
No per-volume license
An enterprise-grade open SIEM platform, without the per-gigabyte fees that inflate traditional SOCs.
Shared team, dedicated attention
12 professionals in the response chain, with a SOC manager named for your company from week one.
You pay for what you use
Pricing based on actual event volume and chosen retention, not on an estimated asset count.
No billing surprises
Deployment for half a monthly fee, taxes included and cost broken down by component in the proposal.
Expensive, slow and hard to sustain
- ✕At least 6 analysts in shiftsJust to cover 24 hours, not counting specialists, vacations and turnover.
- ✕SIEM license and storage on topCosts that grow with log volume.
- ✕Months to become operationalHiring, training and writing rules before detecting the first attack.
Ready, predictable and auditable
- ✓24x7x365 operation in 12 weeksTwo-wave deployment, with assisted operation until go-live.
- ✓One monthly fee, all includedPlatform, team, storage, threat intelligence, automation and reports.
- ✓SLA with penaltiesA discount on the monthly fee if a critical incident notice is late.
A real-world example
Industrial company with distributed sites and about 800 assets
- 24 log source types integrated in 12 weeks: firewalls, domain controllers, about 670 workstations, servers, Microsoft 365, Oracle and SQL Server.
- From about 195 to 22 alerts per day after 90 days of tuning: the team only sees what matters.
- About 5 confirmed incidents per month, each with a ticket, evidence, MTTD and MTTR.
- 12 months of history searchable in seconds, with no restore, to investigate and hunt threats retroactively.
- 03:12 · Detection
- Correlation links the new privileged account to the serial sign-ins
- 03:18 · Notice
- The company's focal point receives the alert with context
- 03:29 · Containment
- Playbook isolates the endpoint and blocks the IP at the firewall
- 08:00 · Leadership
- Report with timeline, root cause and next steps
Illustration of a typical ransomware scenario, with every time within the critical incident SLA.
SLA by severity
Ransomware, compromised domain account
Updates every hour, 24x7x365.
Lateral movement, unauthorized privileged access
Updates every 4 hours, 24x7x365.
Failed brute force, policy violation
Daily updates, 24x7x365.
Compliance deviation, rule tuning
Weekly updates, business hours.
Platform with 99.5% monthly availability. Aligned with MITRE ATT&CK, NIST CSF 2.0, NIST SP 800-61, ISO/IEC 27035, CIS Controls v8 and LGPD (arts. 46 and 48).
One incident. Years of earnings.
Change Healthcare · 2024
Ransomware, UnitedHealth results (Reuters).
PIX provider · 2025
Breach via a supplier (Brazilian press).
Maersk · NotPetya · 2017
Destructive malware via a compromised update.
MGM Resorts · 2023
Social engineering, SEC Form 8-K.
Standards the market and regulators recognize.
NIST CSF 2.0
CIS Controls v8
ISO/IEC 27001
OWASP ASVSFind out your real cyber risk.
Independent assessment with financial quantification and an executive roadmap.