Four pillars, in sequence
Fourarmed's work is based on four pillars: Audit, Accredit, Monitor, Develop.
They are meant to run in that order. Find out where you stand, get certified to the standard your customers ask for, keep the picture current, and bring your staff up to a level where they stop being the easiest way in. Most clients start with the audit and take the rest at their own pace.
Everything we do is quoted as a fixed price, which is agreed to in writing before work starts.
A structured review of your systems, controls, software and people, delivered on site and reported at board level. You get a plain-English summary for directors, a full technical report for whoever runs your systems, and a prioritised action plan that tells you what to fix first. It includes a business interruption assessment, which puts a number on what downtime would actually cost you.
A lighter-touch alternative when you want a view of where you are exposed without commissioning the full audit. This produces a risk register, likelihood and impact ratings, and a remediation roadmap. Often the right answer when a board or an insurer has asked a question you need to answer quickly.
Gap analysis, remediation support and the certification itself. Cyber Essentials Plus is increasingly mandatory for government and defence contracts, and it is turning up in ordinary corporate procurement too. We take you through the whole process, including the April 2026 scheme changes that catch out organisations certified under the old question set.
Continuous monitoring of your network, endpoints, email and sign-ins, with an escalation path established in advance so nobody is deciding what to do at two in the morning. Includes vulnerability scanning and phishing simulation, and produces monthly reports you can use at insurance renewal and in client security questionnaires.
Scoped, authorised testing that establishes whether someone trying to break in would succeed. We help clients scope and run testing across external infrastructure, internal networks, web applications, wireless and social engineering.
Interactive workshops, phishing simulations and scenario exercises, built around your business instead of a generic module. Phishing was the most common attack type reported by UK businesses in 2025/26, affecting 38% of respondents, so this is not a soft add-on to the technical work.
Incident response planning, tabletop exercises and escalation design. Only 25% of UK businesses have a formal incident response plan, and the ones that do recover faster.
Ask us about incident response planning on a call. It is usually scoped alongside an audit or a monitoring engagement.
Every service on this page is quoted as a single fixed price, agreed to in writing before any work starts. The figure reflects the scope we set together, and it does not change if the work turns out to be larger than expected.
We do this so you can take a plan to your board with a real number on it. It also removes the argument about whether a piece of work was necessary, because the scope was agreed upon before anyone started.
Every conversation starts free and without obligation. We will tell you what we would look at, what it would involve and what it would cost, in writing, before you commit to anything.
Call, email, or send us a message. We will tell you what we would look at, what it would involve and what it would cost, in writing, before you commit to anything.
