Identity · Patching · Detection · Recovery
Cyber security company in Romania for teams without a security department
In shortWeDevelop is a Romanian software company that runs cyber security as a standing process: identity and MFA, patching, hardening, monitoring with defined response windows, tested backups and incident response, aligned with ISO 27001 controls and NIS2 readiness work. It suits companies without their own security team that need evidence for a client, insurer or auditor. It is not a 24/7 SOC.
At a glance
- Provider
- WeDevelop, a software company from Romania
- Clients
- Romania, the EU, the UK and North America
- Languages
- English and Romanian
- Invoicing
- EUR, GBP or RON
- Pricing
- Quoted after scoping, from your brief
- Contact
- office@wedevelop.ro
01Is this for you
When outside security help makes sense
Most companies do not need a security department to reach a sensible baseline. They need someone who owns the routine work. This service fits when several of these are true.
- A client, insurer or auditor is asking for evidence of your security controls.
- A customer contract has added security clauses, often passed down from NIS2.
- Nobody clearly owns patching, access reviews or restore tests.
- Former staff or suppliers may still have access, and no one can produce a list.
- You have had an incident or a near miss and do not want to repeat it.
02What you get
What changes once the work is running
The results are controls you can point to and records that show they ran.
A ranked gap list
Your position against CIS and ISO 27001 controls, with severity, effort and cost per gap, so the order of work is clear.
Access under control
SSO and enforced MFA, least-privilege roles, shared credentials removed and secrets taken out of repositories and configs.
Patching on a calendar
A current asset inventory with patch windows set by severity, and a record of what was applied and when.
Alerts someone answers
Central logs, alert routing and a runbook per alert class, with response windows agreed in advance and on-call cover for critical alerts.
Rehearsed recovery
Immutable off-site backups where the platform allows, scheduled restore tests and tabletop incident exercises.
Evidence on request
A monthly report plus evidence packs for ISO 27001 audits, insurers and enterprise security questionnaires.
03Which option
A security tool, one remediation project, managed security or a 24/7 SOC
The commercial question is how much ongoing security work you buy, and from whom. Each level below costs more to sustain than the one before it, and each one suits a different risk.
| Model | Fits when | Trade-off |
|---|---|---|
| A security tool on its own | A specific gap has been identified and someone will operate the tool. | An EDR or WAF that nobody watches changes little. You have bought a control, not a process. |
| Assessment and one remediation block | You have an IT team that can keep controls running once the gaps are closed. | Controls drift as people, suppliers and software change, unless someone owns the calendar afterwards. |
| Managed security with defined response windows | You need a standing process and regular evidence, but your risk does not justify round-the-clock analysts. | Detection is business-hours with on-call for critical alerts. This is what we provide, and it is not a 24/7 analyst floor. |
| 24/7 security operations centre | Your risk profile or a contract genuinely requires eyes on alerts at all hours. | A different cost base and a different business. We do not run one, but we help you procure it. |
Two more things sit outside our scope. Accredited penetration tests come from a third party, whose findings we scope and remediate with you. If a matter is heading to court or an insurance claim, a licensed forensic examiner should be brought in early.
04Cost
What decides the cost of cyber security services
The assessment and remediation are quoted as defined pieces of work, and ongoing operation as a monthly retainer. These are the factors that move both.
| Factor | Why it matters |
|---|---|
| People and accounts | SSO, MFA, role design and access reviews scale with the number of people and the applications they use. |
| Systems and endpoints | Servers, containers, cloud accounts and laptops all have to be inventoried, hardened and patched. |
| Starting point | A company with basic hygiene needs a much shorter remediation block than one with shared passwords and no inventory. |
| Monitoring coverage | The number of log sources and the response windows you agree decide the size of the operating work. |
| Evidence required | ISO 27001 packs, NIS2 or DORA readiness and insurer questionnaires add documentation on top of the controls themselves. |
| Your current IT provider | Working alongside an incumbent needs agreed roles, and that takes coordination at the start. |
Tools are bought after the plan rather than before it. The highest-risk items, usually MFA, backups and patching, tend to be fixed first and before anything expensive is purchased.
05How to start
From first conversation to a running process
Share what you have
A list of systems, who administers them, past incidents and any obligations coming from your sector or contracts.
Assessment
A posture review against recognised controls, ending with a ranked list of gaps and a plan. You can stop here if your team will do the fixing.
Remediation block
The critical gaps are closed in one defined piece of work, typically identity, patching, secrets and backups.
Keep it running
Monitoring, patch windows, access recertification and phishing simulation on a calendar, with a restore test each quarter and two tabletop exercises a year.
06For an accurate quote
What to include in your request
You do not need a security policy to get started, and a short honest list is more useful than a polished one.
- The number of people, and the main applications and systems they use.
- Who administers your IT today, in-house or through a supplier.
- Past incidents, even small ones.
- What triggered the request: a contract clause, an insurer, a tender or NIS2.
- Any evidence you must produce, and by when.
07Questions
Questions buyers ask about cyber security services
How much do cyber security services cost for a company?
The cost depends on the number of people and systems, your starting point and the evidence you need, so we quote after an assessment. Expect a defined figure for remediation and a monthly retainer for operation, with tools only added where the plan justifies them.
How quickly can our company be better protected?
Most risk reduction arrives in the first remediation block: an assessment of two to three weeks followed by four to eight weeks of closing critical gaps. The timing varies with your starting point, and MFA, backups and patching usually come first.
Do you offer 24/7 security monitoring?
No, we provide business-hours managed detection with agreed response windows, an on-call rotation for critical alerts and a runbook per alert class. If your risk or a contract truly needs analysts around the clock, we will say so and help you procure that service.
Can you run a penetration test for us?
We carry out adversarial review with the source code and infrastructure in hand, which finds many problems an outside test would miss. We are not a certified testing house, so when a contract or a regulator requires a formal test, an accredited third party performs it and we remediate the findings.
Does NIS2 apply to my company?
It may, either directly if you fall into a covered sector and size, or indirectly through security clauses from customers who are covered. A readiness assessment shows the likely category and the gaps, and your legal adviser should confirm the conclusion, since this is a legal question as well as a technical one.
Is WeDevelop ISO 27001 certified?
Yes, WeDevelop operates a certified ISO 27001 information security management system, and the certificates are available on request. That certificate covers how we work and does not extend to your company, although the assessment can show what your own certification would involve.
What happens if we are attacked during the contract?
The agreed incident plan runs: contain, preserve evidence, find the entry point and restore from verified backups, followed by a written report with a timeline. Notification deadlines such as the GDPR 72 hours are tracked from the moment of awareness, and the contract states who does what.
Request a quote
Describe what you need. The enquiry goes to our team, and we reply by email with the next step.