Glowing red hexagon path leading to a city skyline at night

Tested. Defended. Proven.

The global cybersecurity consultancy that finds the forgotten VPN before attackers do.

Frameworks we work to

ISO/IEC 27001SOC 2PCI DSS v4.0.1NIST CSF 2.0GDPRNIS2DORAHIPAACMMCMITRE ATT&CKOWASPIEC 62443ISO/IEC 42001EU AI Act

We keep your business protected from every direction, wherever you operate.

Taglogy is a global cybersecurity consultancy working with clients around the world. We test your defences, watch for attacks, build the governance your regulators expect, and step in when something goes wrong. Each service works on its own, and they get stronger together, so you stay a step ahead of attackers and audits alike.

Test

Prove what an attacker can actually reach.

Defend

Watch, harden and reduce the ways in.

Govern

Put ownership, policy and evidence behind security.

Respond

Contain the damage and get back to work.

See all 14 services →

Penetration Testing Red Teaming App & API Security Managed SOC & MDR Cloud Security Identity & Zero Trust OT & ICS Security Awareness & Phishing vCISO GRC & Compliance Data Privacy AI Security Incident Response Ransomware Readiness

The cost of getting it wrong

The average data breach now costs $4.99 million worldwide, a record high.

Average breach cost by sector

Healthcare$6.64M
Financial services$6.29M
Technology$5.50M
Industrial$5.50M

Source: IBM Cost of a Data Breach 2026, via eSecurity Planet

Check your readiness →

Network lines connecting cities across the Earth at night

247days on average to identify and contain a breach, the first rise in five years.IBM, 2026
31%of breaches began with an exploited vulnerability, now the top way in.Verizon DBIR, 2026
48%of breaches involved ransomware, and the same share involved a third party.Verizon DBIR, 2026
$1.93Mlower breach costs for organisations using security AI and automation extensively.IBM, 2026

A global problem needs global cover

Attacks cross every border. Your defence needs to be ready in every time zone.

See it early. Monitoring across endpoint, identity and cloud.
Stop it quickly. Agreed containment steps and tested playbooks.
Recover with proof. Tested backups and evidence for your regulators.

Explore managed SOC →

Illustrative animation, not live attack data. Drag to rotate.

Attack path simulator

Cut the chain, and see which controls change the outcome.

This is how we explain risk to boards. The red point takes the shortest open route to your customer data. Switch on controls and it has to find another way.

Simplified example network. Scroll sideways on a small screen.

Find the real paths through your network

A report in a folder protects nothing

We stay until the fix is in place and the retest proves it worked.

Authorisation comes first. Unauthorised access is a crime in most countries, so no test starts until the right owner has signed off.
People do the hard part. Experienced testers find broken logic and chain weaknesses together.
Risk in business terms. Your board gets a page it can act on, and your engineers get the detail.
Proof of the fix. We retest what you've repaired, so you can show auditors and customers where you stand.

Data centre aisle with server racks and status lights

Scope
Agree goals, targets and legal authorisation.
Assess
Test the systems and review the controls.
Report
Rank the findings and walk through them with you.
Fix
Work with your team on remediation.
Prove
Retest, then give you evidence you can share.

The first 72 hours

In a breach, the deadlines start early.

Pick a point on the clock to see what should be happening, and which regulators around the world may expect to hear from you.

Incident response →

T+0

Something is wrong

Isolate affected systems from the network, and leave them powered on

General guidance. Deadlines depend on your sector, country and the data involved. Source: CyberDefenders, September 2026.

Which rules apply to you?

Rules change by sector and by country. Tell us about your business for a starting list.

What best describes you?

Where do you operate or have customers?

Do any of these apply?

Your starting list

Frameworks to review

A starting point for your own review, not legal advice. Your regulators and legal counsel decide what applies.

Read the full cybersecurity compliance guide

Industries

Risks and rules change by sector. So does our approach.

Free readiness check

Ten questions. A straight answer on where you stand.

It takes about three minutes, runs entirely in your browser and needs no email address. You get a score and your three most important next steps.

Start the check →

Insights

Practical notes for leaders who have to decide.

Glowing shield with a check mark on a circuit board

Regulation · 6 min read

Cyber incident reporting deadlines around the world

From 2 hours in Singapore to 60 days under HIPAA: the main cyber incident reporting deadlines in the EU, UK, US, Asia Pacific and what they mean for your plan.

Buyer guide · 7 min read

How to choose a penetration testing company

Twelve questions to ask a penetration testing company, what a good report contains, and the warning signs of a scanner sold as a penetration test.

Security operations room with wall screens showing charts

Leadership · 5 min read

vCISO vs full-time CISO: how to decide

Compare a virtual CISO and a full-time CISO on cost, availability and regulator expectations, with a simple way to decide which one your company needs.

Questions we hear

Straight answers on cybersecurity for growing businesses.

See all questions

What does a cybersecurity consultancy do?

A cybersecurity consultancy assesses your risks, tests your defences, helps you meet regulations and improves how you detect and respond to attacks. Taglogy does this for organisations worldwide, with services ranging from penetration testing to managed monitoring and virtual CISO leadership.

Where does Taglogy work?

Taglogy works with clients worldwide. Most assessment and advisory work is delivered remotely, and on-site work can be arranged where a project needs it. Our head office is in Dubai, United Arab Emirates.

Which cybersecurity regulations apply to my company?

It depends on your sector, your customers and where you operate. Common examples include ISO 27001, SOC 2 and PCI DSS through customers and card schemes, GDPR and NIS2 in the EU, HIPAA and SEC rules in the US, and national laws elsewhere. Our compliance finder gives you a starting list.

How much do cybersecurity services cost?

Cost depends on your scope, size and risk. Penetration tests are priced by the number of assets and their complexity. Monitoring is usually priced by users, devices or data volume. vCISO services are priced by hours. Taglogy provides a written scope and fixed or capped quote before work starts.

What should a small or mid-sized company do first?

Start with the controls that stop the most common attacks: phishing-resistant MFA for email and admins, tested offline or immutable backups, endpoint detection, fast patching of internet-facing systems, and staff trained to report suspicious messages. Our free readiness check can show you where to begin.

How do I choose a penetration testing company?

Ask to see a sample report, who will do the testing and what their experience is. Check that the work is mainly manual, that a retest is included, how authorisation is handled, how test data is stored, and whether the provider's accreditations are current and relevant to your regulator.

Talk to a Taglogy consultant

Tell us what prompted you to get in touch. We'll reply with next steps, and we're happy to sign an NDA first. Please leave out passwords and sensitive technical details for now.

Metal padlock in front of a red hexagon wall