Cybersecurity
Architecture, engineering and operations across eleven security domains, from zero-trust identity and XDR to OT and IoT, incident response and threat intelligence.
Cybersecurity, DevSecOps, Software and IT Services
Engineering Supremacyin cybersecurity.
Royal RS Conglomerate designs, builds and operates cybersecurity programmes, software platforms and IT services for large enterprises. Cloud-delivered, aligned to ISO 27001, PCI DSS and POPIA, with 24-hour managed detection and response.
13Service domains
52Capabilities delivered
24hMonitoring and response
30Technology partners
What we do
What we do
We combine security, software delivery and IT operations so that protection is built in from the start. All solutions are delivered as services or software.
DevSecOps and Software
Secure CI and CD pipelines, application security testing and infrastructure-as-code guardrails, plus custom web and data applications built and hosted for you.
IT Services
ITSM and ITOM, observability, automation, analytics, data platforms, integration and AI governance for large enterprise environments.
Service explorer
13 domains. 52 capabilities.
Security, IT operations and software engineering, delivered as services and cloud software. Select a domain to view the services in it.
Domain 01 of 13
Discuss this domain Identity and Access
Directory, lifecycle and policy, the new perimeter.
Identity and Access Management
IAM and IDaaS. Directory, lifecycle, policy
Single Sign-On and Multi-Factor Authentication
SSO and MFA including FIDO2. Adaptive and passwordless
Privileged Access Management
PAM and PIM. Session control and vaulting
Identity Governance, PKI, KMS and CIEM
Entitlements and cryptography
Typical engagement
Passwordless MFA rollout, least-privilege entitlements, PAM vaulting
Outcome
Fewer credential-based breaches and audit-ready access reviews
Frameworks
ISO 27001 A.5 and A.8, POPIA section 19, NIST CSF PR.AA
Domain 02 of 13
Discuss this domain Endpoint and Extended Detection
Prevention, telemetry and cross-domain correlation with 24-hour expert eyes.
Endpoint Protection, Detection and Response
EPP and EDR. Prevention and telemetry
Extended Detection and Response
XDR. Cross-domain correlation
Network Detection and Response
NDR. East-west analytics
Managed Detection and Response
MDR and MSSP. 24-hour expert monitoring
Typical engagement
EPP and EDR deployment, XDR correlation, 24-hour MDR onboarding
Outcome
Detection and containment in minutes on every endpoint
Frameworks
MITRE ATT&CK detection coverage, CIS Controls 10 and 13
Domain 03 of 13
Discuss this domain Security Analytics and Response
Central analytics, automated playbooks and a common adversary language.
Security Information and Event Management
SIEM. Central analytics
Security Orchestration, Automation and Response
SOAR. Playbooks and actions
MITRE ATTandamp;CK Mapping and Reporting
Common language
Threat Intelligence Platform and Breach and Attack Simulation
TIP and BAS. Validate and prioritise
Typical engagement
SIEM build or migration, SOAR playbooks, ATT&CK-mapped use cases
Outcome
One pane of glass with automated triage and executive reporting
Frameworks
ISO 27001 A.8.15 and A.8.16, PCI DSS Req. 10
Domain 04 of 13
Discuss this domain Cloud and Application Protection
Posture, workload, API and edge resilience across every cloud.
Cloud-Native Application Protection Platform
CNAPP with CSPM, CWPP and CIEM. Posture and workload
API Security and Web Application Protection
WAAP. Abuse and OWASP
Application Security Testing
SAST, DAST, IAST, RASP and SCA. DevSecOps loop
DDoS Protection and Bot Management
Edge resilience
Typical engagement
CNAPP posture baselines, WAAP tuning, AppSec in CI and CD
Outcome
Secure-by-default cloud landing zones and release pipelines
Frameworks
CIS Benchmarks, OWASP Top 10 and API Top 10
Domain 05 of 13
Discuss this domain Network and Edge
Zero-trust access, deep inspection and smart connectivity.
Secure Access Service Edge and Security Service Edge
SASE and SSE. SWG, CASB, ZTNA and FWaaS
Zero Trust Architecture
Never trust, always verify
Firewall as a Service and Cloud IPS and IDS
Policy, not appliances
Protective DNS and Secure Web Gateway
Cloud-delivered filtering
Typical engagement
SASE and SSE design, ZTNA rollout, NGFW and SD-WAN refresh
Outcome
Identity-aware access for every user, site and workload
Frameworks
NIST SP 800-207 Zero Trust, ISO 27001 A.8.20 to A.8.22
Domain 06 of 13
Discuss this domain Data Security
Discover, classify, protect and recover the data that matters.
Data Loss Prevention
DLP. Endpoint, network and cloud
Data Security Posture Management
DSPM. Discover and classify
Encryption, Tokenisation and Key Management
Protection in depth
Backup, Restore and Disaster Recovery
DRaaS. Resilience
Typical engagement
DSPM discovery, DLP policy design, encryption and DR testing
Outcome
Sensitive data mapped, controlled and recoverable
Frameworks
POPIA sections 19 to 22, GDPR Article 32, CCPA, PCI DSS requirements 3 and 4
Domain 07 of 13
Discuss this domain Email and Human Layer
Advanced email defence and a human firewall that keeps improving.
Secure Email Gateway and Integrated Cloud Email Security
SEG and ICES. Advanced detection
Brand and Domain Protection
DMARC, SPF and DKIM. Abuse and spoofing
Security Awareness and Behaviour Change Training
Quarterly programmes
Phishing Simulation and Coaching
Human firewall
Typical engagement
SEG and ICES deployment, DMARC enforcement, quarterly awareness
Outcome
Measurable phishing-click reduction and brand-spoofing shutdown
Frameworks
ISO 27001 A.6.3, PCI DSS 12.6, NIST CSF PR.AT
Domain 08 of 13
Discuss this domain Governance, Risk and Compliance
From the board to operations, policy, audit, continuity and risk.
Policies, Standards and Internal Audit
From board to operations
Compliance with ISO 27001, PCI DSS, POPIA, GDPR and COBIT
Regulatory alignment
Business Continuity and Disaster Recovery
Plan, test, refine
Enterprise Risk Management
Register and KRIs
Typical engagement
Policy frameworks, internal audit, BC and DR plans, risk registers
Outcome
Board-level visibility and evidence packs for every audit
Frameworks
ISO 27001 and 27002, COBIT 2019, PFMA and King IV alignment
Domain 09 of 13
Discuss this domain OT and IoT Security
Safety-first segmentation and full visibility of the connected estate.
Operational Technology and ICS Security
Segmentation and safety
IoT Security Monitoring
Discovery and control
Asset Discovery and Visibility
Know your estate
Network Access Control Policy
NAC. Who gets in
Typical engagement
OT asset discovery, segmentation design, NAC enforcement
Outcome
Safety-first visibility across plants, sites and devices
Frameworks
IEC 62443, NIST SP 800-82, ISO 27001 A.8.20
Domain 10 of 13
Discuss this domain Testing and Incident Response
Adversary-informed testing, containment and forensics.
Red, Blue and Purple Teaming
Adversary-informed
Penetration Testing
External and internal
Incident Response and Digital Forensics
DFIR. Contain and analyse
Threat Hunting
Find the silent
Typical engagement
Pen tests, purple-team exercises, IR retainers, DFIR
Outcome
Validated defences and a rehearsed, contractually-backed response
Frameworks
PCI DSS Req. 11, ISO 27001 A.5.24 to A.5.28, NIST SP 800-61
Domain 11 of 13
Discuss this domain Enterprise IT Operations
Service management, observability and automation for modern IT estates.
ITSM and ITOM
ServiceNow and Atlassian. Service and operations
Observability
Logs, metrics and traces. Splunk, Elastic, Datadog and New Relic
DevOps and CI and CD Pipelines
Build, test, release
Automation, Workflows and RPA
Remove toil
Typical engagement
ITSM rollout, observability platform build, CI and CD and runbook automation
Outcome
Fewer incidents, faster change and measurable service levels
Frameworks
ITIL 4, COBIT 2019, DORA metrics
Domain 12 of 13
Discuss this domain Software and Data Solutions
Custom applications, data platforms and responsible AI, engineered and hosted for you.
Custom Web Application Engineering
Cloud-native, secure by design
Data Platforms and Integration
iPaaS and APIs. Snowflake, Databricks, warehouse and lakehouse
Analytics and BI Dashboards
Power BI and Tableau
AI Safety and Governance
Policies and model risk
Typical engagement
Discovery, UX design, agile build, performance testing, managed hosting
Outcome
Secure applications compliant with POPIA and GDPR, delivered on Cloudflare, Azure or AWS
Frameworks
OWASP ASVS, ISO 25010, POPIA, GDPR, ISO 42001
Domain 13 of 13
Discuss this domain Intelligence and OSINT
Surface, deep and dark web intelligence across your brand and supply chain.
Surface, Deep and Dark Web Intelligence
Breadth of sources
Impersonation and Brand Abuse Detection
Protect identity
Leaked Data Monitoring and Evidence Capture
Screenshots and trails
Third-Party and Supply-Chain Risk Intelligence
Vendors and subcontractors
Typical engagement
Dark-web monitoring, brand-abuse takedowns, supplier risk scoring
Outcome
Early warning on leaks, impersonation and third-party exposure
Frameworks
ISO 27001 A.5.7 and A.5.19 to A.5.22, POPIA section 21
Custom software
Applications built for your business.
We design, build, test and host custom web applications, data platforms and analytics dashboards, with security, POPIA and GDPR compliance built in from the first sprint.
How it runs
Our operating model
Signals from your environment flow through detection and automation to expert response, and back into governance reporting.
Signals from
- Identity and endpoints
- Cloud and applications
- Network and email
- Data, OT and IoT
- 01
Detect
SIEM, XDR and NDR correlate signals across the estate.
- Central analytics
- Cross-domain correlation
- MITRE ATT&CK mapping
- 02
Automate
SOAR playbooks contain threats in minutes.
- Isolation and revocation
- Enrichment and triage
- Ticketing and alerts
- 03
Respond
24-hour analysts investigate, hunt and resolve.
- Managed detection and response
- Threat hunting
- Incident response and forensics
- 04
Govern
Evidence flows into board, audit and compliance reporting.
- Monthly executive reporting
- Risk register updates
- Compliance evidence packs
Continuous tuning. Detections, playbooks and controls improve every cycle.
Security model
Defence in depth
Seven protective layers around your most important systems, data and people. Select a layer to see what it covers.
Layer 1 of 7
Governance and Risk
From the board to operations, policy, audit, continuity and risk.
- Policies, Standards and Internal Audit
- Compliance with ISO 27001, PCI DSS, POPIA, GDPR and COBIT
- Business Continuity and Disaster Recovery
- Enterprise Risk Management
Layer 2 of 7
Human and Email
Advanced email defence and a human firewall that keeps improving.
- Secure Email Gateway and Integrated Cloud Email Security
- Brand and Domain Protection
- Security Awareness and Behaviour Change Training
- Phishing Simulation and Coaching
Layer 3 of 7
Network and Edge
Zero-trust access, deep inspection and smart connectivity.
- Secure Access Service Edge and Security Service Edge
- Zero Trust Architecture
- Firewall as a Service and Cloud IPS and IDS
- Protective DNS and Secure Web Gateway
Layer 4 of 7
Endpoint and XDR
Prevention, telemetry and cross-domain correlation with 24-hour expert eyes.
- Endpoint Protection, Detection and Response
- Extended Detection and Response
- Network Detection and Response
- Managed Detection and Response
Layer 5 of 7
Cloud and Application
Posture, workload, API and edge resilience across every cloud.
- Cloud-Native Application Protection Platform
- API Security and Web Application Protection
- Application Security Testing
- DDoS Protection and Bot Management
Layer 6 of 7
Identity and Access
Directory, lifecycle and policy, the new perimeter.
- Identity and Access Management
- Single Sign-On and Multi-Factor Authentication
- Privileged Access Management
- Identity Governance, PKI, KMS and CIEM
Layer 7 of 7
Data
Discover, classify, protect and recover the data that matters.
- Data Loss Prevention
- Data Security Posture Management
- Encryption, Tokenisation and Key Management
- Backup, Restore and Disaster Recovery
How we engage
Our engagement model
A five-stage engagement model with defined outputs at every step, giving procurement, risk and technology teams clear visibility of progress.
Assess
Threat modelling, gap analysis against ISO 27001 and NIST CSF, asset discovery and attack-surface review.
Delivers a risk register and roadmapArchitect
Target-state design covering zero-trust identity, segmentation, cloud posture, data protection and detection coverage mapped to MITRE ATT&CK.
Delivers a reference architectureImplement
Certified engineers deploy, integrate and harden the platform using DevSecOps pipelines and infrastructure-as-code.
Delivers a hardened platformOperate
24-hour managed detection and response, SOAR playbooks, threat hunting and vulnerability management with agreed SLAs.
Delivers monthly SOC reportingAssure
Red and purple teaming, BAS validation, compliance evidence packs and continuous improvement reviews with your board.
Delivers an audit evidence pack
Large Enterprise
Built for large enterprises
We work within POPIA, GDPR and other major privacy regulations, formal procurement processes and hybrid on-premise environments, and structure engagements to transfer skills to your team.
ISO 27001ISO 27002PCI DSSPOPIAGDPRUK GDPRCCPAHIPAACOBITNIST CSFMITRE ATT&CKCIS ControlsOWASP
- Vendor-neutral, partner-certifiedCertified skills across 24 platforms. We recommend what fits your environment and deliver it with certified engineers.
- 24-hour monitoring and responseManaged detection and response with defined SLAs, automated containment and monthly executive reporting.
- Compliance as an outputEvery engagement produces evidence packs aligned to ISO 27001, PCI DSS, POPIA, GDPR and COBIT.
- Knowledge transfer built inRunbooks, training and shadowing so your team can operate the platform independently.
- Local presence, global standardsHeadquartered in Rosebank, Johannesburg, with on-site and remote delivery.
Security situation room
Security operations in motion
How our SOC handles telemetry, triage and automated containment.
Mean time to detect3.2min
Mean time to contain14min
Events per day2.4M
Auto-contained87%
MITRE ATT&CK tactic coverage
Partners and skills
Partners and certified skills
Certified skills across cloud, security, data and application platforms, so recommendations are based on fit for your environment.
Cloud and Platform
- Microsoft
- Azure
- AWS
- Google Cloud
- Cloudflare
- ServiceNow
- Atlassian
- Red Hat
- VMware
- HashiCorp
Security
- CrowdStrike
- Palo Alto Networks
- Fortinet
- Okta
- Ping Identity
- Proofpoint
- Mimecast
- Tenable
- Rapid7
- Zscaler
Data, Observability and Apps
- Splunk
- Elastic
- Datadog
- New Relic
- Snowflake
- Databricks
- Power BI
- Tableau
- Mendix
- OutSystems
Start here
Request a security posture review.
A two-week engagement that maps your exposure against MITRE ATT&CK and your compliance obligations, with a prioritised roadmap.
Contact
Get in touch
Tell us about your environment and requirements. We respond within one business day.
Phone 010 002 3353
Email Send us a message
HoursMonday to Friday, 08:00 to 17:00 GMT+2
SOC and incident response: 24-hour
SOC and incident response: 24-hour