Frequently asked questions.

Elmfort provides a complete, outsourced cybersecurity and operational resilience function. We monitor threats, manage vulnerabilities, maintain security governance and compliance evidence, coordinate incident response and verify that you can recover from disruption.

We also offer AI Enablement & Transformation, Managed Workplace IT, Managed Cloud and Software Engineering.

UK organisations with fewer than 250 employees with sensitive data, compliance obligations or critical technology dependencies. Our service is particularly well suited for financial services, professional services and B2B technology companies.

Request a proposal. We arrange a discovery call to understand your organisation, technology and obligations. Then we recommend the right services and send you a fixed proposal.

Five capabilities: Security Operations, Governance & Compliance, Operational Resilience, AI Security & Governance and Security Leadership. Every plan includes all five. Higher plans add more governance, assurance, testing and security leadership.

See the capabilities

Yes. Our contracted security operations centre (SOC) partner monitors and investigates security events 24 hours a day, 7 days a week. The SOC can take agreed containment actions, for example to isolate a compromised device.

Standard plans do not include unlimited 24/7 incident command, forensic investigation or production engineering. Your agreement states which containment actions the SOC can take and who responds to critical escalations. Enhanced incident response retainers are available.

Your entire relevant technology estate: employees, devices, identities, email, SaaS applications, networks, servers, cloud infrastructure, applications, development environments, AI systems and critical suppliers.

Coverage is not identical for every system. Some SaaS providers expose few security logs, while cloud platforms can expose many. During onboarding, we set the monitoring for each material system, document its limitations and record any gap that remains.

Onboarding has seven stages:

1. Discovery: we identify your users, devices, applications, infrastructure, AI systems and critical suppliers.
2. Risk assessment: we identify the material security and resilience risks.
3. Security architecture: we set the security requirements, access and monitoring design.
4. Platform integration: we deploy sensors, connect security telemetry and configure the governance platform.
5. Resilience assessment: we identify critical services, recovery requirements and dependencies.
6. Operational integration: we agree remediation workflows and a responsibility matrix.
7. Service acceptance: we verify monitoring, escalation and the required controls, and we both sign.

The service acceptance records what we monitor, how we escalate and which gaps remain open. Onboarding is a separately priced engagement.

No. We prepare you for assessment and manage the evidence. The certification body makes the certification decision. Every plan includes Cyber Essentials certification. Sentinel also includes Cyber Essentials Plus, which is optional on other plans. Sentinel includes an ISO 27001-aligned ISMS too.

The Cyber Resilience Assurance Report. It tells you what is protected, what risks remain, what we fixed, whether recovery works and which decisions need your approval. You receive it quarterly on Foundation and monthly on Assured and Sentinel.

See an example report

Each plan has a monthly organisational fee, a rate for each staff member and a minimum monthly subscription: Foundation £3,500, Assured £5,500, Sentinel £9,500. Prices exclude VAT. The security software we need to deliver the service is included.

Our standard prices are based on a set of assumptions about your technology estate. They fit most small and medium-sized organisations.

Some estates need more monitoring, licensing or specialist work than the standard price allows. Examples are production servers and cloud environments, Kubernetes, custom AI applications and agents, high volumes of security logs or long retention periods, specialist compliance requirements and complex recovery dependencies.

We absolutely still cover these systems, but pricing may increase beyond our standard prices.

Estimate your price

Onboarding, additional estate complexity, major remediation, significant projects, third-party business application licences and cloud hosting consumption. We quote these separately.

Yes. Complex infrastructure is part of the service. It only falls outside the standard published price. We include its security and resilience requirements in a tailored fixed-price proposal.

Yes. Every Managed Cyber Resilience plan includes baseline AI security and governance: an acceptable-use policy, an AI inventory and risk register, awareness training and baseline assurance of custom AI and agents. Custom AI applications and agents with material business permissions need extra technical assessment.

Yes. AI Enablement & Transformation covers strategy, workplace AI rollout, workflow automation, agents and managed AI services.

See AI Services

With an AI opportunity assessment. It is a fixed-price engagement that gives you a prioritised list of use cases, a business case for each and a practical roadmap.

We scope each project against the business process, the integrations, the risk and the expected value, and send you a proposal. We do not publish standard project prices.

It is optional, and we recommend it. With Managed Workplace IT, Elmfort runs your everyday IT to the same security standards, and one partner is responsible for both. Any other IT operator must meet our security and cooperation standards.

Microsoft 365 licensing, unlimited in-scope remote support, device management and patching, identity administration, Microsoft 365 backup, business password management, SaaS administration and IT service management.

See everything that's included

Monday to Friday, 9am–5pm UK time as standard. We can extend these hours to suit your organisation. Security monitoring continues 24/7 through your Managed Cyber Resilience plan.

£350 per month plus £99 per staff member, excluding VAT. It is added to a Managed Cyber Resilience plan.

This price applies when you use our preferred managed technology platform. Moving to the platform may involve migration work. We include that work in the initial onboarding cost.

Estimate your price

Hardware purchases, connectivity, specialist business application subscriptions, major migrations and extensive on-site projects. We can quote for these separately.

Yes, through our Managed Cloud service. Managed Cyber Resilience on its own assures the security and resilience of your infrastructure, but it does not operate it.

About Managed Cloud

Cloud infrastructure, application and container hosting, databases, deployment pipelines, monitoring and cost management.

Yes. We host them in sandboxed environments, give each agent its own identity and only the permissions it needs, keep secrets in a managed vault, require human approval for consequential actions and log every action.

Hosting agentic applications

Your service agreement sets support hours, response times, availability targets and recovery objectives. Out-of-hours engineering is available where your services need it, and we agree it in the contract.

We scope each environment and send you a fixed monthly proposal for its operation. Migration is a separately quoted project. Cloud provider charges are separate from our management fee.

Business applications, integrations and APIs, internal tools, and updates to ageing applications.

About Software Engineering

Each stage of development has its own security controls: threat modelling at design, peer review of every code change, automated scanning of each change, and security testing before each release.

Yes. Our support service covers security updates, fixes and improvements, monitoring and long-term maintenance. We agree the scope, support hours and response times before go-live.

Yes. We can help your team build security into its development lifecycle, from threat modelling to security checks in your pipelines. We can also help your developers adopt AI coding tools and agents with the right guardrails in place.

Working with your team

You do. You own the source code, documentation and pipelines.

We scope each project and deliver it in phases with agreed outcomes. We do not publish standard project prices, because scope differs for each organisation.

Elmfort

Runs your security, governance and resilience programme. Prioritises risks, coordinates remediation and incident response, verifies fixes and recovery tests, keeps the evidence and reports to your leadership team.

Our security operations partner

Monitors security events 24/7, investigates suspicious activity, takes agreed containment actions and escalates confirmed threats.

Your IT operator

Operates your systems day to day, applies fixes and configuration changes, and performs restorations. With Managed Workplace IT, Elmfort does this for your workplace technology.

Your organisation

Names accountable contacts, makes business decisions, accepts residual risk and approves high-risk changes and AI deployments.

We agree a responsibility matrix during onboarding.

The SOC detects and investigates the incident and takes agreed containment actions. It escalates confirmed threats to Elmfort and your nominated contacts. Elmfort coordinates the response and tracks the incident through remediation, verification and reporting.

We prioritise it by business impact and assign it to the operator of the system. We monitor the agreed deadline, verify the fix and record the evidence. If a fix does not happen, we escalate it to your management.

Only the access that the agreed services need. For Managed Cyber Resilience, this typically means security agents on laptops and supported servers, connections to Microsoft 365 and your identity provider, read access to cloud audit logs, and integrations with supported SaaS applications. We agree each integration during onboarding.