Documented cybersecurity transformations

Challenge

Bullhost had an operational SOC with strong technical capability, but without a formalised professional structure: no documented procedures, services not yet catalogued and no capacity to compete for demanding or larger clients. The technical knowledge was there, but the operation was not packaged as a sellable managed service.

Approach

Strategic SOC consultancy that started in late 2023, with ongoing accompaniment (now in its third year). Redesign of operational processes and procedures and drafting of runbooks. Definition and structuring of the service catalogue into three teams —Blue, Purple and Red— with SLAs and commercial models. Orientation towards European data sovereignty and active support in commercial positioning to reach higher-complexity contracts. This was consultancy and strategic accompaniment: we did not run Bullhost's day-to-day SOC operations.

Outcome

“At Bullhost we greatly value having chosen Hodeitek as our development partner, as they bring great value to our SOC. Thanks to their automations we have optimised our detection and response processes, significantly reducing manual tasks through workflow orchestration and thereby improving the operational efficiency of our cyber-intelligence team.”

Challenge

The SOC team was spending excessive time on repetitive tasks: threat analysis, notification drafting, report generation. MTTD was around 45 minutes. Clients had no real-time visibility into their security status.

Approach

Custom development project for Bullhost. We built a platform combining software engineering and artificial intelligence with SOAR to automate Bullhost's SOC operations. Fine-tuned Ollama models deployed on sovereign European infrastructure. Automation of threat analysis, notification drafting and report generation. SOAR drastically cuts response times. Bullhost operates two portals: one external for its clients (with real-time visibility) and one internal (with incident management and KPIs). The platform is owned and operated by Bullhost.

Outcome

“Going from 45 minutes to under 10 seconds in MTTD is not an optimisation — it is a category change. Bull-Eye lets us operate with a fraction of the manual workload and gives our clients something almost nobody offers: real-time visibility on 100% European infrastructure.”

Challenge

AZK Taldea is a branding and digital marketing agency: its asset isn't the servers, it's reputation —its own and that of the brands it manages—. It started with no active defence at all: no EDR, no firewall, no corporate VPN, no secrets management and no security culture. And with a surface almost nobody sees: the agency hosts its own clients' websites, so a single incident wouldn't compromise one team, it would compromise the trust the entire business rests on.

Approach

A deployment across three mutually reinforcing layers. Technical layer: 24/7 EDR and MDR with Bitdefender GravityZone, a Palo Alto next-generation firewall with VPN for remote work and secure access to internal servers and storage, and secrets management with 1Password. Human layer: team training and real phishing simulations. Extended chain: secure hosting and infrastructure for AZK's clients' websites. And, before starting, we managed the SPRI cybersecurity grant that made the project viable.

Outcome

“We're an agency: we live on our clients' trust and on our own reputation. Hodeitek understood that from day one. We went from having no defence at all to enterprise-grade security —endpoints, people and even our clients' websites— and on top of that they managed the SPRI grant to make it possible. They're the partner you want when security isn't your business, but your reputation depends on it.”