Triminus

Security operations, run from Switzerland

Security Operations

Tailored to your risk profile, a pragmatic eye on your alerts. Security where you need it.

Who it is for

Any size, IT and OT. Alongside your IT team, not instead of it.

You run the business or its IT, and security keeps landing on your desk. A small firm with no security staff, or a large company with a lean IT team? If you want security taken care of, start with a call.

Starting from your risk profile

Your risk profile determines the scope.

Your assets

  • Which systems and data matter most
  • How exposed they are
  • What your team handles itself

Your package

  • The sources
  • The detections
  • The service hours
  • Vulnerability management, if needed

In scope of an optional vulnerability management plan:

  • A realistic, threat-based review of your assets and their exposure
  • A remediation plan your IT team or provider can act on
  • Follow-up until the fixes are verified

Getting started

It starts with a conversation, not a form, for a limited number of clients.

  1. A first call to see whether Triminus fits. Bring what you have, however vague.
  2. A closer look with you and your team: what you run, what worries you, what you need.
  3. Your individual service plan: the tier, the sources, the response targets by severity, and anything else you need. Severity depends on your environment, so you set it together.
  4. Ramp-up of processes, sources and detections. If included, vulnerability management starts too. On Act, you sign off the containment actions in writing first.
  5. Service starts, and your first monthly review follows. From there the set-up grows with you. Extra hours can be added when needed.

Three ways in

Three starting points, not boxes. Your individual package is shaped around your needs during initial conversations.

  1. Observe

    Your sources connected, detections built for your environment, and a monthly look at the results.

    Your logs go into your own SIEM. No SIEM yet? Then into one that Triminus runs in Switzerland. Sign-ins, devices and cloud apps feed detections built for your environment and tuned as you go. Every month, a written review of the findings.

  2. Investigate

    The alerts that matter in your environment get a person, not a queue, during service hours. Afterwards you get a written account.

    Observe, plus: alert triage, followed across accounts, devices and cloud. Each incident gets a classification and a write-up. Once a month, a threat hunt goes beyond your detection baselines.

  3. Act

    Investigate, plus pre-authorised actions under your runbooks: fine-tuning of detection rules, containment and reporting.

Your tools

Together, we build on your existing infrastructure, make an assessment and take it from there. No SIEM yet? Set-up, hosted and run for you in Switzerland. Some examples:

SIEM

  • Elastic
  • Splunk
  • Wazuh

Endpoint

  • Microsoft Defender
  • Palo Alto Cortex

Cases and threat intel

  • TheHive
  • MISP

OT

  • Claroty

Ask for the full list, or bring your own.

Already running automated or agentic triage? Triminus works alongside it and takes on its escalations.

Service hours

You and Triminus set your service hours together. During service hours, your call reaches the founder.

For emergencies outside service hours there is a documented escalation path to the contact named in your agreement. Alerts are not watched outside service hours; they are handled on the next service day.

Night service is not part of the start. Once detections and alerts are familiar, occasional cover is possible.

Limits

  • Triminus monitors the sources listed in your individual service agreement during service hours.
  • With new clients, Triminus does not provide coverage at all hours. Service hours are agreed with you.
  • Triminus does not offer a night service; occasional cover is possible later in a relationship.
  • Triminus does not promise to catch or stop every attack. Triminus’s commitments are in your agreement: response targets within service hours, defined actions, documented work.
  • Patching, fixing and rebuilding systems stay with you, your IT team or your IT provider. Triminus plans the remediation and checks the result.
  • No IT operations: no helpdesk, backups or user administration.
  • Containment on control systems (OT) is agreed case by case. It depends on your set-up and on who may make changes. Without such an agreement: monitoring, investigation and escalation only. No programming or operating of control systems.
  • No negotiation with attackers, including in ransomware cases.