Cyber questions.
Plain English answers.

Samaryam Tech is a Glasgow based cyber security consultancy for small and medium sized organisations. We help you understand your risks through Cyber Compass, make targeted improvements and maintain resilience through exercises, reviews and ongoing advice.

Cyber Compass is the usual starting point when you need clarity. It reviews your current arrangements and gives you your Top 5 business risks, practical quick wins and a prioritised roadmap. If you already have a defined requirement, we can scope that service directly.

Discover establishes your current position through Cyber Compass. Strengthen addresses your priorities through Security Foundations, Cyber Education and Awareness and Incident Readiness. Sustain rehearses and tests your arrangements through Tabletop Exercises and penetration testing, with a Cyber Resilience Partnership providing agreed ongoing guidance and reviews. You can enter the journey wherever your needs fit.

Our team combines decades of experience across military and intelligence environments, public sector security leadership and commercial cyber delivery. Sam remains closely involved in client delivery, with specialist associates contributing their expertise through a coordinated team. We apply that experience through clear intent, disciplined planning and practical advice, explained in plain English.

Yes. We agree responsibilities with your IT team or managed service provider. After an assessment, audit or identified need, Security Foundations can help create or improve policies and documentation, implement controls, address findings or configure and deploy solutions. The work is shaped around the outcome you need, with individually scoped fixed price modules and project management where required.

Your initial discovery call is free, with no obligation to go ahead. Cyber Compass starts from £250. We agree the scope and fixed fee before work begins. Security Foundations is modular: each piece of work is itemised and individually priced as a fixed price engagement, so you choose what fits your needs. Other services have their own starting prices or a tailored quote, based on audience, preparation, complexity and delivery requirements.

No. We are based in Glasgow and support organisations across the UK. Remote delivery is available, and in person workshops or visits can be agreed where appropriate.

Cyber Compass is a consultant led review of your cyber security arrangements across people, process and technology. It explains your current position and turns the findings into practical business priorities.

We review ten domains: governance and leadership; people and awareness; identity and access; devices and endpoints; data protection; backup and recovery; incident response; third party risk; monitoring and detection; and business continuity.

You receive a Cyber Compass report, your Top 5 business risks, a colour coded view of your current position, practical quick wins and a prioritised improvement roadmap. A management readout helps you understand the findings and available options.

The assessment follows five steps: discovery, assessment, analysis, reporting and a management readout. We use a structured questionnaire and discussion to understand the arrangements in place and the evidence available.

Cyber Compass starts from £250. Your organisation’s size, complexity and review requirements determine the fixed fee. Scope and price are agreed before the assessment begins.

No. Cyber Compass is an advisory assessment. Technical testing, implementation and certification are separate services with their own agreed scope. Findings reflect the information and evidence available at the time of review.

No. You can use the roadmap with your own team or IT provider. If you want help delivering the improvements, Security Foundations turns the priorities into practical work across policies, documentation, controls and systems. You choose individually scoped modules with itemised fixed prices, or we can discuss an ongoing resilience programme.

Security Foundations is practical delivery shaped around the priorities identified in an assessment, audit or business need. It connects the requirement to the work needed across policy, documentation, controls, remediation, engineering and systems. That may mean reviewing or improving something you have, creating something missing or implementing a new capability. You can commission a single module or combine several into a coordinated project.

Six connected areas shape the offering: policy and governance; documentation; security controls; remediation; configuration and engineering; and systems and solutions. The need determines the work. For example, a policy gap may call for a review or a new policy, while a technical finding may require a configuration change, an engineered fix or deployment of a suitable solution.

Yes. A module could be a focused policy review, writing the documentation you need, implementing a control or deploying a solution. You can choose one defined improvement or combine modules around a wider objective. Every piece is separately scoped, itemised and individually priced at a fixed fee.

Yes. The agreed work can involve configuring existing technology, engineering a change or designing and deploying a new security system or solution. We agree the requirements, systems, access, dependencies, completion criteria and delivery responsibilities, with practical documentation and operational handover included in the relevant scope.

Yes. Project management can be included to coordinate one project or several modules, including responsibilities, dependencies, milestones and progress reporting. This is agreed and itemised in your proposal, so it is clear what delivery support is included.

No. We work alongside your existing IT team or provider where appropriate, agreeing who delivers and operates each improvement. Samaryam Tech can carry out the scoped security work, coordinate specialist input and project manage the delivery where needed. The handover makes ongoing responsibilities clear.

No. Cyber Compass is useful when priorities are unclear, but it is not compulsory. Security Foundations can follow any assessment, audit finding or identified need. If you already know what needs attention, we can scope the relevant work directly.

Every piece of work is individually priced as a fixed price engagement. Your proposal itemises each module, its scope, deliverables and price, including project management or specialist work where agreed. You choose the modules you need and approve the costs before work begins, with no surprises.

We agree the boundaries, dependencies and completion criteria for each module upfront. If your needs change, any additional or revised work is scoped, itemised and priced for your agreement before it starts. We do not add unapproved work or charges to the engagement.

We provide Guided Preparation or Managed Preparation for Cyber Essentials, from initial scope and readiness through questionnaire preparation, assessor queries and closeout. Cyber Essentials Plus readiness and coordination can be separately scoped. Guided and Managed describe the support you receive; your certification route is agreed separately.

Cyber Essentials is a UK Government backed scheme supported by the NCSC. Cyber Essentials is a verified self assessment reviewed by a qualified assessor. Cyber Essentials Plus uses the same five technical controls but adds an independent technical audit to check that the controls are in place. Cyber Essentials certification is a prerequisite for Plus. Preparation support and certification body charges are agreed separately.

In Guided Preparation, your team or IT provider gathers evidence, drafts answers, manages technical actions and enters the portal submission. We provide scoping guidance, a readiness review, recommendations, one follow up preparation session and final quality checks. Managed Preparation includes Guided support, with us driving detailed scoping, coordinating evidence, drafting answers, liaising with your IT provider, tracking remediation and assisting with portal preparation. Your organisation approves the answers in both packages.

Guided Preparation starts from £295 and Managed Preparation from £495 for straightforward environments. Scope, systems, sites, cloud services and supplier arrangements determine the final fixed preparation quote. Our preparation fee reflects complexity rather than employee count alone. Certification body fees, technical implementation, Plus readiness and Plus auditing are separate, with applicable VAT made clear in your proposal.

No. Our consultancy fee covers the agreed preparation and support. The independent certification body charges separately for assessment and certification, normally paid directly by you. Cyber Essentials scheme fees depend on employee count; Plus audit fees depend on the assessment scope and environment. We explain the costs before you commit.

We review the scope and information supporting your answers against the five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. We use the questionnaire and requirements applicable to your assessment account. You receive a colour coded readiness picture, clarification points and prioritised actions, based on the information and evidence available. The certification body performs the formal assessment.

We establish the relevant legal entities, locations, users, devices, networks and cloud services with your team or IT provider. Cloud services hosting your organisation’s data or services must be included. Remote working and personally owned devices used for business are reviewed against the applicable scheme rules. Any proposed exclusions need clear justification and appropriate separation. We document the scope before preparing the submission.

The preparation packages include identifying the actions needed, with remediation coordination and tracking in Managed Preparation. Implementation such as firewall changes, MFA rollout, patch deployment, cloud configuration, new systems or extensive policy creation is separately scoped. Your IT provider can deliver the changes, or Security Foundations can provide itemised fixed price modules agreed before work starts.

An independent IASME licensed certification body assesses your submission and awards certification when the requirements are met. We work with trusted certification partners to coordinate the route to independent assessment. Samaryam Tech prepares and coordinates the engagement; it does not award the certificate or replace the independent assessor.

A board member, director or equivalent authorised senior representative of your organisation must confirm that the answers are complete and accurate before submission. We can guide, review or draft the responses, but they must describe your actual environment and controls. Your organisation retains responsibility for final approval and maintaining the controls throughout the certification period.

We agree a realistic preparation timetable after scoping, based on your readiness, information availability and any technical changes needed. Tell us about tender or commercial deadlines early. We can coordinate with your IT provider and discuss partner Fast Track assessment where available, with additional fees agreed upfront. Fast Track concerns assessor feedback after submission; preparation, remediation and Plus audit availability still determine the overall timeline. A completion date or successful result cannot be guaranteed.

Both preparation packages include reasonable clarification support and support through one formal remediation and resubmission cycle. Guided responses are handled jointly; in Managed Preparation we drive assessor liaison with your input. Required technical changes are separately scoped, and the certification body’s resubmission windows and fees apply. Any further support is agreed before additional work begins.

Yes, as a separate readiness engagement. We can review the intended audit scope, identify preparation needs, coordinate your team and the certification body, and help organise access and audit dates. Plus auditing is carried out independently by the certification body and is separately charged. The Plus audit must be completed within three months of your most recent Cyber Essentials certification. If your certificate is older, the self assessment stage needs to be repeated. We confirm the route and dates with the certification body before proceeding.

No. Cyber Essentials Plus is a defined technical audit against the scheme’s five controls. It provides greater assurance than the verified self assessment, but does not replace a separately scoped penetration test of your website, application or other systems. Certification addresses a baseline of common threats and does not guarantee protection from every cyber attack. We can help you decide what further assurance your risks require.

You receive a completion pack with the agreed certification scope, final questionnaire, remediation record, remaining improvement recommendations and renewal date, plus the certificate when it is issued by the certification body. Guided engagements use a proportionate version of the same records. We also explain sensible next steps for maintaining the controls.

Cyber Essentials and Cyber Essentials Plus certificates expire after 12 months. Your organisation must maintain the controls throughout the year, rather than only preparing for renewal. A separately scoped renewal review refreshes your scope, questionnaire and readiness. A Cyber Resilience Partnership can provide agreed regular reviews, such as a monthly touchpoint with your team or IT provider, to track changes to users, devices, cloud services, access and updates. Renewal preparation is included where agreed, with technical remediation separately scoped through Security Foundations.

Yes. You can prepare using the official resources and buy an assessment directly from a certification body. Our fee is for the scope, readiness, preparation and coordination support around that assessment. You choose the level of help that fits your organisation.

Eligible organisations can opt in to cyber liability insurance at no extra cost when they certify their whole organisation. They must be domiciled in the UK or Crown Dependencies and have annual turnover under £20 million. The included policy has a £25,000 total limit and is subject to its terms, excesses and exclusions. Check the current IASME eligibility and policy details.

The voluntary pledge encourages board responsibility for cyber security, use of the NCSC Early Warning service and a risk based approach to requiring Cyber Essentials across supply chains. Certification helps suppliers respond to those expectations. Signing the pledge is a separate commitment with its own actions.

No. We help you understand the requirements, address preparation gaps and submit accurate answers. Certification depends on the controls in place and the independent assessor’s decision. Neither a preparation package nor priority handling guarantees a pass.

The agreed scope can include public facing websites, developed applications, APIs and integrations, or networks. The testing approach depends on the assets, access, depth and boundaries authorised for the engagement.

A vulnerability assessment identifies and prioritises potential weaknesses. Penetration testing includes controlled attempts to validate how weaknesses could be exploited and what their impact could be, within agreed limits. We agree the appropriate approach or combination during scoping. A vulnerability assessment should not be treated as equivalent to a penetration test.

Every engagement includes a scoping session, testing for the agreed time and depth, a full report with remediation recommendations and a findings readout. The report combines an executive summary with technical findings, evidence, severity, impact and testing limitations. Agreed time for retesting identified fixes is included; the coverage and timing are defined in the scope.

Testing starts from £750 per day of testing. The quote reflects project size, complexity, assets and testing depth. We confirm the agreed price, deliverables, testing time and included retesting allowance before work begins. Technical implementation and any additional testing are separately scoped.

Relevant guidance such as OWASP WSTG, PTES and OSSTMM informs the approach selected for your scope. MITRE ATT&CK can inform applicable attack scenarios. These resources support the testing methodology; they do not mean that every technique or every possible attack is included in an engagement.

Yes, where we have written authorisation and an agreed test environment and scope. We confirm access, boundaries, dependencies and the effect of any differences between development and the intended live environment.

Yes. Security Foundations can turn prioritised testing findings into scoped remediation work, from configuration changes and engineered fixes to implementing controls or deploying a suitable solution. Each module is separately itemised and individually priced at a fixed fee. Implementation is separate from the testing engagement and its agreed retesting allowance.

No. Cyber Essentials Plus is an independent technical audit against the scheme’s five controls. A penetration test investigates exploitable weaknesses in the assets and scenarios agreed for that engagement. The two can complement each other, but neither replaces the other. Cyber Essentials preparation, Plus auditing and penetration testing have separate scopes and costs.

No. Testing is a point in time assessment within the agreed scope and limits. New vulnerabilities and attack techniques continue to emerge, and no test can guarantee 100% security.

It is practical education that helps people recognise cyber risks, respond appropriately and know when to ask for help. Sessions are tailored to the organisation, the audience and the risks they encounter at work.

Topics can include phishing, social engineering, AI enabled scams and impersonation, passwords and MFA, data handling, remote working, suspicious activity, incident reporting, invoice fraud, business email compromise and leadership responsibilities. We select topics around the risks and responsibilities of the audience. Leadership threat briefings connect relevant threats to your business context and priorities.

Yes. We tailor the content for staff, managers and strategic leadership. Finance teams can focus on false invoices, supplier impersonation and payment verification. HR and customer facing teams receive learning relevant to their responsibilities, while leadership threat briefings support department heads, executives and boards.

Delivery can combine presentations, discussion, phishing message examples, demonstrations, guided learning activities and facilitated Q&A. The aim is to build understanding and confidence in an approachable environment. Rehearsing a crisis response is a separate Tabletop Exercises service.

Choose a focused awareness session of up to 60 minutes, a 90 minute leadership threat briefing, a half day workshop of approximately 3 to 4 hours or a full day programme of approximately 6 to 8 hours. We can also shape a bespoke programme across several days or audiences. The format and duration are agreed around your learning objectives.

Our experience spans teaching young people in schools and extracurricular clubs such as Scouts and cadets, alongside instructing and briefing young trainee soldiers, graduates, people changing careers and executive leadership, including delivery in multiple languages. We adapt the pace, depth and approach to the audience. Any language requirements are discussed when scoping the engagement.

Yes. A bespoke multi day or multi audience programme can use different content for teams, managers and leaders. Audience size, business context, delivery requirements and priority threats shape the quote.

We agree a tailored quote based on the audience, topics, preparation, session length and delivery arrangements. Your proposal makes the included sessions, responsibilities and practical takeaways clear. Any additional work is agreed before it starts.

Yes. Remote sessions or in person delivery can be agreed around your audience and format. We confirm the venue or platform, group size, participation arrangements and any travel requirements as part of scoping.

A tabletop exercise is a facilitated simulation that tests how people, plans and decisions respond to an incident. Participants discuss the scenario and make decisions without attacking or disrupting live systems.

A Tactical Skirmish focuses on one team, process or playbook, typically for up to two hours. An Operational Cross Functional exercise explores coordination, escalation and continuity across business functions, typically over three to four hours. A Strategic Executive Crisis exercise focuses on leadership judgement, stakeholders, reputation and recovery priorities, typically over three to four hours. We agree the duration and challenge around your objectives.

We agree a tailored proposal based on the objectives, audience, scenario complexity, preparation, duration and delivery requirements. It sets out what is included, your responsibilities and any separately scoped support. Additional work is agreed before it starts.

Every exercise includes bespoke scenario design, facilitation, a debrief, an After Action Report, recommendations and a scorecard. The emphasis is on identifying lessons and practical improvements.

Scenarios can include ransomware, business email compromise, a data breach, payment fraud, a critical outage, a supply chain incident or privileged account compromise. We choose a scenario around your objectives and participants.

No. It is not an exam. Success means challenged assumptions, better questions, clearer responsibilities and useful actions to improve readiness.

Our experience includes extensive time planning, participating in and delivering UK Armed Forces exercises to prepare people for battle and decisions under pressure. It also includes delivering exercises to third sector organisations in Scotland and crisis scenarios for Government and executive audiences. We translate that experience into proportionate, accessible facilitation for your organisation.

Exercises are most useful when participants have plans, responsibilities and escalation arrangements to rehearse. We review what is available during scoping. If those arrangements need to be created or refreshed first, a separately scoped readiness review or Incident Readiness engagement can help you prepare.

Yes. Exercises can progress across Tactical, Operational and Strategic levels over six to twelve months, with lessons addressed between sessions. Suppliers, partners or other stakeholders can join where their participation and confidentiality arrangements are agreed. More complex wargaming or multi day exercises are scoped separately.

The After Action Report, recommendations and scorecard help you prioritise improvements. Your team can act on them, or you can arrange separate support to refresh response plans, deliver education, implement fixes through Security Foundations or maintain a programme within a Cyber Resilience Partnership.

We create, review or refresh incident response plans, scenario specific playbooks, cyber continuity and recovery arrangements, and crisis communications. Supporting work can include roles and deputies, escalation criteria, contact arrangements, decision records and team walkthroughs. You can commission one focused piece or a connected planning project, tailored to your priorities.

The response plan coordinates how an incident is recognised, escalated and managed. Continuity arrangements help protect your ability to do business and operate in adverse conditions by setting out how essential activities can continue during disruption. Recovery arrangements set priorities and dependencies for restoring systems, information and services. Communication arrangements connect them, so people know who approves and shares updates.

Yes. We review how your current arrangements fit the business, identify gaps and revise the agreed documents. A focused refresh can follow a business or system change, assessment, audit, incident or exercise. Useful existing material is retained and connected rather than replaced unnecessarily.

Yes. We can develop playbooks for agreed scenarios such as ransomware, suspected data loss, compromised accounts, email fraud or a critical supplier outage. Each is based on your environment and sets out relevant triggers, roles, escalation and decision points. Specialist technical response procedures are agreed with the people responsible for carrying them out.

Usually the business owner or leadership representative, operational owners and the people responsible for IT. We involve finance, HR, communications and external providers where relevant. We agree participants upfront so responsibilities, dependencies and practical constraints are reflected in the plans.

No. Start with the gap or priority you need to address. That could be a review, one playbook, communication arrangements or a connected set of plans. Your proposal specifies the work, documents, workshops, responsibilities and fixed price before delivery begins.

An agreed briefing and walkthrough help people understand their roles and reveal unclear ownership or dependencies. A separately scoped tabletop exercise can then rehearse decisions, communication and escalation. Technical recovery testing is also scoped separately. A plan or walkthrough does not guarantee the outcome of a real incident.

Your team and providers can address the agreed actions, or commission modular implementation through Security Foundations. A Cyber Resilience Partnership can include scheduled plan reviews, updates and exercises within its agreed programme. Documents have named owners and a review approach; ongoing delivery is agreed separately.

This service is about preparation. Live incident assistance, availability and response commitments must be specifically agreed. It is not a 24/7 emergency response hotline.

It is a continuing cyber advisory and support relationship, shaped around your organisation. It can combine senior guidance, fractional cyber leadership and an agreed programme of reviews and practical activities, giving your priorities continuity beyond an individual assessment or project.

Depending on your needs and scope, it can include strategy sessions, leadership and board advisory, fractional CISO support, risk and control reviews, programme coordination, Cyber Essentials renewal preparation, education, exercises, testing, plan refreshes and incident support. The agreement specifies what is included; every service is not automatically bundled into a retainer.

A fractional Chief Information Security Officer, also described as a virtual CISO or vCISO, provides an agreed part time cyber leadership role. This can cover strategy, governance, risk priorities, leadership reporting, supplier oversight and guidance on security investment. Responsibilities, time and authority are agreed with your organisation; leadership retains its business decisions and accountability.

No. Cyber Compass is a useful way to establish your position and priorities, but you can start with an existing assessment, audit, roadmap or identified business need. We agree the starting point and any discovery required before shaping the partnership.

Yes. The partnership works alongside your team and providers, helping connect business priorities with technical ownership and delivery. We agree who advises, who implements and who checks the work. Specialist or technical activities are included only where specified, or commissioned separately.

Yes. The agreed programme can include control reviews, change tracking, action reviews, evidence and scope refreshes, and Cyber Essentials renewal preparation. Certification and Cyber Essentials Plus assessment remain independent. Certification body charges, technical remediation and any separately commissioned preparation or assessment work are set out in the agreement or proposal.

Yes, where expressly agreed. Support can include incident advisory, decision support, coordination with your team and response providers, and defined investigation or technical assistance. The agreement sets the activities, included time, availability, contact route and any response commitments. A general retainer does not imply 24/7 monitoring, guaranteed emergency availability or unlimited response work.

The fee reflects the role, included time, planned activities and support arrangements your organisation needs. We agree these in writing, together with the term and review arrangements. Work outside the retainer is separately scoped and approved before delivery; Security Foundations modules have individually itemised fixed prices. Third party charges are identified separately.

We agree a frequency that fits your needs. Sessions can cover progress against the roadmap, current risks, changes to the business, control ownership, supplier dependencies and investment decisions. They help leadership understand what has changed, what needs attention and who owns the next actions.

Yes. Regular reviews revisit priorities, organisational changes and the support that is most useful. We agree changes to activities, time, fees or incident arrangements together. A partnership can remain focused on one need or develop into a broader resilience programme.