Cybersecurity Services
A practical cybersecurity programme has five layers — and most SMBs in Türkiye have gaps in three of them. We map your gaps and close them in priority order, not all at once.
Identity
Entra ID + Conditional Access + MFA + passkey — the highest-leverage control.
Endpoint
Defender for Endpoint P1/P2, Sophos, Kaspersky via Intune. EDR + ASR + tamper protection.
Defender for Office 365 anti-phishing, sandboxing, anti-impersonation. SPF/DKIM/DMARC.
Data + Recovery
Purview labels, DLP, audit log, Acronis immutable backups, restore test.
Five layers
We use a defence-in-depth model adapted for SMB scale:
- Identity — Entra ID + Conditional Access + MFA + passkey for privileged accounts. The single highest-leverage control.
- Endpoint — Microsoft Defender for Endpoint P1 or P2 (or Sophos / Kaspersky alternatives) deployed via Intune. EDR + ASR rules + tamper protection.
- E-mail — Defender for Office 365 P1 or P2 — anti-phishing, attachment sandbox, URL detonation. Plus SPF + DKIM + DMARC enforced.
- Data — Microsoft Purview Sensitivity Labels, DLP policies, audit log retention. Critical for KVKK + sectoral confidentiality.
- Recovery — Acronis Cyber Cloud with immutable backups, monthly restore test, runbook.
Vendor partnerships
Microsoft (Defender / Entra / Purview), Sophos (firewall, MDR), Kaspersky, Xcitium (Comodo), Acronis. Selection depends on fit, not commission — we recommend native Microsoft where it covers the requirement at lower TCO.
Frequently Asked Questions
For Microsoft 365-based organizations the default is the native Microsoft Defender suite — Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps — because integration is tight and TCO is lower than mixed stacks. We add Sophos firewalls at perimeter, Kaspersky for legacy Windows scenarios, Acronis for backup-with-anti-ransomware.
MFA is the baseline; Microsoft has reported very large reductions in account-compromise risk for accounts protected by MFA. Passkeys (FIDO2) are the next step, providing phishing-resistant authentication that adversary-in-the-middle attacks cannot easily capture. Our recommendation: MFA universal today, passkey rollout for admin users immediately.
We deploy Microsoft Sentinel for SIEM and write the rule set. For 24/7 analyst-in-the-loop monitoring we partner with established MSSPs rather than running a 24/7 SOC ourselves — being honest about scope: a small consultancy should not pretend to operate a full SOC.
Step one: Acronis immutable backups, tested monthly. Step two: Defender for Endpoint blocks most variants pre-execution. Step three: incident-response retainer covers containment, forensics, recovery and KVKK breach notification within the 72-hour window.
How Xen Bilişim delivers Cybersecurity Services
- 1. Discovery: Stakeholder interviews, current-state inventory, compliance review and risk mapping; deliverable: written discovery report.
- 2. Plan: Target architecture, SKU/licence selection, migration plan and SLA scope documented; quote signed.
- 3. Implement: Phased rollout with pilot → full deployment; user training and runbook delivered; KVKK/ISO compliance evidence collected.
- 4. Operate: Continuous monitoring, quarterly health-checks, incident response and roadmap reviews — under MSP retainer or project-end transfer.
Typical end-to-end timeline: 4-6 weeks (varies by scope).