Alana Vestergaard
Co-founder & Chief Executive
Incident responder by trade. Led the DFIR practice at a national consultancy before co-founding NCPS. CISSP, GCFA.
Our story
We started because the same organisations kept getting hit.
In 2011, three incident responders kept arriving at the same kind of scene: a 300-person credit union, a regional hospital group, a machine shop supplying a defense prime. Each had genuine regulatory obligations, a two-person IT department, and a security posture assembled from whatever their MSP happened to resell.
Enterprise security vendors would not serve them at that size. Managed IT providers sold them antivirus and called it a security programme. The gap was structural, and it was where the losses were happening.
So we built the thing that was missing: a security operation priced for the mid-market that behaves like an enterprise one. Staffed around the clock. Authorised to act. Measured on published service levels. Able to hand an examiner evidence without a scramble.
15 years later the model has not changed, and neither has the ownership. We have never taken outside capital, never been acquired, and never asked a client to sign a three-year lock-in. The renewal rate is the argument we would rather make.
What we will not do
- Resell what we would not run. If we would not put our own analysts behind a product, we do not sell it to you.
- Audit and remediate the same control. We will not grade our own homework, and we will say so when asked.
- Offshore your telemetry. All monitoring and response is performed by US-based employees, never subcontracted.
- Hold your data hostage. Export on demand, in open formats, including on the way out the door.
- Sell fear. If a control is not worth what it costs you, we will tell you not to buy it.