Protect your business.Prove your readiness.
CyberTusk is the security and governance team growing businesses don't have in-house. We fix what matters, keep it that way, and give you evidence your board, auditors and customers will accept, all for a fixed monthly fee.
My IT provider says we're fine. I have no way to check.The owner
A client sent a 60-question security form and we lost three weeks.The sales lead
Finance nearly paid a fake supplier's ‘new bank account’.The finance manager
Most growing businesses have the same three security problems.
Not exotic hackers. Ownership, recovery and proof. We fix all three for a fixed monthly fee, starting with a paid three-week check so you know exactly what you are buying.
Nobody owns security day to day
Tools were bought over the years, alerts pile up, and when something looks wrong at 10am nobody is sure who acts.
Backups have never been tested
The dashboard says ‘success’. Nobody has restored anything, and the recovery plan lives in one person's head.
Security questionnaires slow down deals
Every customer review starts from a blank page. Evidence is scattered and the audit date keeps getting closer.
Eight services, each built around a problem you already have
Every service starts with what businesses like yours tell us, then what we do and what you receive. Prices are starting points for up to 50 staff; we confirm scope in writing before quoting.
Cyber & GRC Health Check
A fixed-fee, three-week assessment that ranks your real risks and ends with a 90-day plan.
Microsoft 365, identity & cloud security
Lock down accounts, email, files and devices, with every change tested, documented and reversible.
Managed security operations
Every alert gets a named owner in business hours. We investigate, tune out the noise and coordinate action.
Vulnerability assessment & penetration testing
We test your external systems and web apps the way an attacker would, then retest after you fix.
Managed GRC & audit readiness
Risk register, practical policies and maintained evidence, so an audit takes two days, not two months.
Privacy operations & supplier assurance
Map where sensitive data goes, review the suppliers that matter, and answer questionnaires in days.
Business continuity & recovery readiness
Agree what must come back first, write the plan, then actually restore something to prove it works.
Staff awareness & payment-fraud resilience
Short, role-based sessions and a simple rule for verifying bank-detail changes. We measure reporting, not just clicks.
What happens when an alert fires at 10am on a Tuesday
Most businesses have the tools. What they lack is a person who owns the alert. Here is the path every in-scope alert follows with CyberTusk.
Signal
Defender, Microsoft 365 or your firewall raises an alert.
Acknowledge
A named person picks it up within the agreed target: one hour for P1.
Investigate
Sign-ins, devices and mailbox rules are checked to confirm what is real.
Contain
Pre-agreed actions: disable an account, isolate a device, block a sender.
Report
Your contact is updated; it goes in the incident register and monthly report.
One clear path from “are we OK?” to “here’s the evidence”.
You can stop after any step. Each one stands on its own and ends with something you keep.
Assess
A fixed-fee Health Check finds what could realistically hurt the business and ranks it.
Improve
Approved fixes become a separately priced project with clear deliverables and acceptance criteria.
Operate
Named people run the agreed routine: posture checks, alert triage, scans, restore tests.
Demonstrate
Evidence and decisions are kept current, ready for your board, auditors and customers.
The Cyber & GRC Health Check
Three weeks, fixed fee. We interview management and IT, sample the accounts, devices, backups and policies that matter, and rank what could realistically hurt the business.
- A short executive report in plain language
- Your top five risks, each with an owner, a decision and a due date
- A 90-day improvement plan with effort and cost estimates
- A management readout where you approve, defer or reject each item
Half credited against your first improvement project. You keep the report either way.
Agree scope and access
Interview and sample
Rank what matters
Decide together
Ongoing cover with named people and defined hours
After the Health Check, most businesses move onto one of three plans. Each covers one company, one Microsoft 365 tenant and up to 50 staff and devices.
Foundation
“We have an IT provider. We need someone to keep governance moving and check their work monthly.”
- Monthly risk and action review
- Monthly identity and device posture check
- Quarterly external vulnerability scan
- Quarterly staff awareness session
- Monthly management report
Managed Protect
“Nobody owns our alerts. We want someone watching and following up.”
- Everything in Foundation
- Human alert triage, business hours
- Monthly external vulnerability scan
- Quarterly sample backup restore test
- Posture issues followed through to closure
Protect + Trust
“We sell to overseas or enterprise clients. Security questionnaires are holding up deals.”
- Everything in Managed Protect
- One customer questionnaire per month (up to 50 questions)
- Monthly risk and evidence review
- Quarterly management review meeting
Plans start after a Health Check (or an equivalent recent assessment we have reviewed). One-time onboarding — access, telemetry, contacts, workflow tests and your starting report — is quoted separately. Software licences, log and backup storage, 24/7 monitoring, external audit fees and legal advice are never hidden inside a plan. Larger teams are priced on the extra work involved. Annual agreement, monthly billing, 30 days' notice.
No unexplained “security score”.
Every line in your monthly report is a business question with a number you can check, and it ends with the decisions we need from you.
Illustrative data only. This is a reporting example, not a client result.
Recognised frameworks, explained in plain language
We use established frameworks to organise the work. We prepare you; independent bodies certify. We will never promise a guaranteed audit result.
Govern
Someone is accountable for every important risk and decision, and management can see them.
How we organise every assessment
Govern, Identify, Protect, Detect, Respond, Recover: a simple map your board can follow.
Readiness for certification
We prepare your controls and evidence. An independent certification body does the audit.
Readiness for attestation
We help you get controls and evidence in order. A qualified CPA firm examines and reports.
Personal Data Protection Act
Practical privacy actions aligned to the Act, with legal interpretation from qualified counsel.
Rooted in heritage. Built for a safer world.
The elephant has stood for strength, memory and loyal protection across Sri Lankan heritage for centuries. We take the same approach to your business: steady, watchful, and there when it matters.
A shared security function, not another vendor
We act as the security and governance team for businesses with a lean IT function, connecting practical fixes to routines and evidence management can use.
We own security, not the helpdesk
We work alongside your IT provider and take named security responsibilities: who patches, who owns backups, who approves changes is written down.
The routine keeps running
A report on a shelf fades fast. We keep the controls, evidence and decisions current every month.
Scope you can actually see
Named people, defined hours, published starting prices and a report that shows exactly what was covered.
People who make tools work
Defender, firewalls and backups only help when someone reviews, tunes and tests them. That is our job.
Three founders. Clear accountability.
Every engagement has a named technical, operations and client owner, with backups for each.
Nimesh De Silva
Vishwa Basnagoda
Sathishka Punyasiri
What we don't do, so you know what you're buying
Not included
- General IT helpdesk and hardware support
- Routine software patching
- Unlimited remediation or major incident recovery
- Legal advice and contract interpretation
Delivered through qualified partners
- 24/7 monitoring and response
- ISO 27001 certification audits and SOC 2 attestation (we prepare you; independent bodies examine)
- Digital forensics after a major breach
- Industrial and factory-floor control systems
Questions owners ask us first
Do you replace our IT provider?
Is the Health Check free?
Do you offer 24/7 monitoring?
Can you get us ISO 27001 certified?
What does "from LKR" mean on your prices?
Will you ask for our passwords?
What happens after I get in touch?
Start with the Health Check
Tell us which system your business can least afford to lose, or which customer review is coming up. We'll scope a fixed-fee check around it and send a one-page proposal within two working days.