01
Assessment
During the workshop, we analyse the tools in use, gaps, costs, responsibilities, incidents, audit findings and contracts. We establish operating, reporting and regulatory requirements.
Security stack
IT security solutions
We select, configure and help maintain IT security tools. We check which assets they cover, how they exchange information and who will handle alerts. A workshop connects risk scenarios to decisions on what to retain, improve, buy or move to a managed service.
Trusted by
Companies and institutions that need stable IT.
Safeguards your team can operate
Several consoles do not yet provide a complete picture of protection. We organise tools, unused licences, responsibilities and costs for companies following an audit or incident, expanding IT or preparing for NIS2, DORA and ISO 27001. Scenarios include account takeover, ransomware, data leakage, vulnerable services, missing logs, user error and failed recovery. The scope covers agreed workstations, servers, accounts, Microsoft 365, networks, applications, backups and regulated data. The application of NIS2/KSC and DORA depends on the organisation’s sector, status and activities. Technical records can support assessment, but do not by themselves confirm compliance or certification.
Main areas of protection
Selection considers existing tools, architecture, integration quality and team capacity. These areas perform different roles.
EDR and device protection
Threat detection and response on workstations and servers. We agree how it works alongside antivirus, updates, encryption and device control.SOC, SIEM and SOAR
Logs, event correlation, detection scenarios, alert analysis and response procedures. We define recipients, escalation thresholds and reporting.MFA and access
Multi-factor authentication for accounts and VPN, with reviews of privileged roles, emergency accounts and access rules for high-risk applications.Backup and recovery
Backups, separated copies, monitoring and restore tests. We agree acceptable data loss and recovery time (RPO/RTO) and procedures for working after an incident.ISO 27001 · TÜV NORD Polska
TÜV NORD Polska has certified Virtline's information security management system to PN-EN ISO/IEC 27001:2023-08. Certificate AC090 121/2469/6137/2026 is valid until February 2029; the document states its scope and exact expiry date. This covers Virtline's own system, not certification of the tools or confirmation of client compliance.
View Virtline's certificateSecurity tool implementation process
Five stages connect purchasing decisions to deployment and ongoing operation. Licences, integrations, pilot scope and acceptance criteria are agreed before changes.
02
Architecture
We define protection layers, log scope, access policies, integrations and supplier dependencies. We decide what to buy, configure better, connect or retire.
03
Pilot
A limited group is used to check policies, alerts, escalation thresholds, exceptions, administrator roles and agreed acceptance criteria.
04
Deployment
We introduce production configuration and check operation. We hand over documentation, response procedures and an operating plan, and train administrators.
05
Review and operation
At agreed intervals, we assess alerts, false positives, asset coverage, backups, reports and costs. We agree next actions and handover to the client team or the scope of a managed service.
Practical scope
What you receive after the project
Acceptance depends on the work commissioned. A workshop delivers decisions and a plan; implementation also delivers configuration, check results and operating rules.
Links between risk, critical services, tools, covered assets and owners. A list of workstations, servers, accounts, tenants, sites and systems identifies coverage and required exceptions.
Purchasing and technical priorities with owners, dates, dependencies, purchase costs and running costs. Minimum and recommended options distinguish urgent work, stabilisation and further development.
Configuration reports, exports or screenshots, pilot findings, alert reports, restore results, review records, decisions and exception lists. We check MFA on critical accounts, log completeness, alert recipients and data recovery. Records can support NIS2, DORA, ISO 27001 or a client audit, but do not guarantee its outcome.
Console administrators, report recipients, updates, ticket handling and alert reviews. Response scenarios define escalation to IT, SOC, management or a supplier, the data collected and the report closing an incident.
What to agree before deployment
The project scope defines access, console administrators, configuration changes, exceptions, alert handling and escalation. We check integration capabilities and licences; a set of products does not mean every feature is available together. Configuration hardening, updates, encryption, device control, privileged access management (PAM), firewalls, VPN and segmentation are separate controls selected for the environment. EDR or MFA alone does not provide them all. Ongoing management and response hours must be agreed; installing a console does not create round-the-clock staffing. Backups and a restore test do not guarantee zero data loss in every incident.
Products and technical work
Each link describes a specific product or deployment scope, not an all-inclusive feature bundle.
-
ESET
Workstation, server and email protection with central management. We select appropriate components and licences rather than attribute every feature to one module.
-
Statlook
IT inventory, licence control and user-activity monitoring. Monitoring scope must be agreed separately in line with the employer's obligations.
-
Microsoft 365
MFA, Conditional Access, email protection and administrator roles according to available licences. Cloud-service backup needs a separately defined scope.
-
IDS/IPS implementation
Detection and blocking of attacks in network traffic, alert rules and monitoring connections. We distinguish IDS/IPS from firewall rules.
-
Firewall implementation
Traffic rules, segmentation, VPN and reduced service exposure as a separate area of network work.
Related services and purchasing
Tool selection may follow an audit, include purchasing or lead to ongoing support.
-
NIS2 audit
Assessment of NIS2 requirements and gaps when they determine security-tool priorities.
-
Cybersecurity
A broader programme of audits, tests, data protection and actions following a gap or incident.
-
IT outsourcing
Administration and ongoing operations, including for companies without a dedicated security team. Responsibilities and support are agreed in the contract.
-
Hardware and software
Purchases based on the agreed plan: new licences and hardware, configuration changes or retirement of redundant tools.
Related topics and information
-
Baseline — projects and tasks
Baseline organises projects, tasks, roles and reports. Virtline configures statuses, data access, integrations and ongoing upkeep. Explore the deployment scope.
-
Secure file exchange — MFT
Business MFT: organised file exchange with partners and systems. Virtline configures access, schedules and alerts, then tests the transferred workflows.
-
IT security services
We help plan and implement IT safeguards against information leaks, cyberattacks, social engineering and system downtime.
Questions about security tools
Where does the workshop start?
+
With risk and a map of current protection: assets, tools in use, console owners, alerts, reports, costs and unused licences. We establish the NIS2, DORA, ISO 27001 or customer requirements relevant to the project. The result is purchasing and operating priorities, decision owners and a plan for further work.
Do we need to buy every tool at once?
+
No. We compare minimum and recommended options and the cost of ongoing operation. Risk determines priorities, which may concern accounts, devices, backups, logs or administrative access. Later stages have owners and dates; buying a tool without configuration, testing and operation does not close a gap.
Can you work with our existing tools?
+
Yes. We can configure tools already used by your company or help select new ones. We assess requirements, architecture, integrations, licences, operating costs and the team's ability to handle alerts. A decision may involve better configuration, connecting systems, retiring a tool or a separately agreed managed service.
How do EDR, XDR and MDR differ from SOC, SIEM and SOAR?
+
EDR detects and responds to threats on devices; XDR connects information from several protection areas. MDR is a threat-analysis and response service, not just a licence. SIEM collects and correlates events, SOAR supports agreed automated actions, and SOC includes the organisation of people analysing incidents. Technical capabilities, staffing, hours and response authority require separate agreement.
Define your security-tool scope
Tell us about current tools, critical services, asset numbers and types, budget and team capacity. Identify major gaps, an audit deadline or a recent incident. We will agree the workshop scope and the decisions it should support.
Discuss your security tools