Cybersecurity Posture
Much of the exposure in a growing business sits in ordinary places: former staff with admin rights, shared logins and apps with write access. We find those first.
Questions we help answer
- Who has administrator access to our store, ad accounts, accounting system and domains, and should they still have it?
- Is multi-factor authentication enforced on every account that can move money or change the website?
- Which third-party apps, agencies and freelancers can read or change our customer data?
- Could someone send email that appears to come from our domain?
- What should we fix first, with a limited budget and no in-house security team?
What we do
Access and identity review
Users, roles, shared credentials and leavers across the business's SaaS, finance and advertising accounts, with multi-factor authentication status for each.
Configuration review
Domain locks, email authentication, admin settings, API tokens and app permissions checked against a written baseline.
Third-party exposure
Apps, agencies and contractors with access to customer or financial data listed with what they can see and change, and whether that access is still needed.
Remediation plan
Findings ranked by likelihood and impact, each with an owner and a date. We carry out the configuration fixes you approve.
Specializt testing through partners
Where penetration testing or continuous monitoring is required, a qualified specializt partner named in the scope delivers it, and its credentials are shared with you before work starts.
- How an engagement with THEFOCUS startsDiscuss this with us
How we approach it
- 01
Read-only first
The assessment is carried out with read access. Nothing is changed until the findings and the remediation plan have been approved.
- 02
Rank by what can move money or data
Accounts that can make payments, change bank details, publish to the website or export customer data are reviewed and fixed first.
- 03
Fix with the account owner
Each change is made with the person responsible for the system, so access removed today is not restored next week for convenience.
- 04
Re-check after the fix
A follow-up review confirms each fix held, including settings that a platform update or a later editor save can reset.
Client results
View allTürkiye · Real Estate & Property Development · 2026
Listing platform prototype and build specification for a cross-border property agency
A licensed property agency selling homes and investment property in several countries wanted one platform for its own stock, partner listings and new developments. We built a clickable prototype, a headless storefront build and a written specification for the full listing and enquiry platform.
Prototype and specification delivered on staging; platform not yet in production
Türkiye · Jewellery & Luxury Goods · 2026
Launch program for a new fine jewellery brand, from positioning to storefront and production equipment
A young jewellery brand preparing to sell direct to consumers engaged us for a multi-phase launch program. So far that has produced the brand position, a built storefront, the sales and social accounts, a product render standard and a purchase recommendation for in-house casting equipment.
Positioning, storefront and equipment decision delivered; brand not yet launched
Türkiye · Retail & E-commerce · 2025‑2026
Audit, measurement repair and paid media relaunch for a design-objects online brand
An online brand selling high-ticket decorative design objects commissioned an audit and put it through an independent quality review. It then had us carry out the findings one ticket at a time and relaunch its search and social advertising.
Fixes verified in production; paid relaunch results not yet measured
Relevant industries
How an engagement with THEFOCUS starts
A first conversation is about your situation. If there is a fit, we propose a scoped diagnostic with a fixed deliverable before any larger commitment.
Discuss this with us01
A working conversation
Forty-five minutes with the person who would lead the work. We ask about the decision, the systems behind it and the deadline.
02
A scoped diagnostic
Read-only access, a fixed timeframe and a written finding: what the records show, what it costs and what to change first.
03
A plan you can act on
Changes, owners, measures and exclusions in writing. The same team then builds and measures, or hands over cleanly.
- One accountable team
- The people who diagnose also build the systems and measure the result.
- Partners chosen per problem
- Independent specializts join for the parts that need them, under one contract.
- Records before dashboards
- Orders, ledgers and logs are reconciled before any recommendation depends on them.
Questions executives ask
Do you carry out penetration testing or run a security operations center?
Not ourselves, and we hold no security certifications. When an engagement needs certified testing or managed monitoring, a qualified specializt partner delivers it under its own credentials and is named in the scope. Our part is the posture assessment, the remediation plan and the configuration fixes you approve.
Will this get us certified under Cyber Essentials or ISO 27001?
We can assess readiness against the controls those schemes cover and help close the gaps. Certification is issued by an accredited or licensed certification body, not by us.
Discuss this with us
A few details help us route your enquiry to the right partner. Fields marked optional can be left blank.