Four disciplines. One security-first standard.

Inventory every log source and asset, map current detection coverage against MITRE ATT&CK, and agree a severity and escalation matrix before anything is deployed.

Deploy and tune the SIEM (Splunk or Wazuh), roll out Sysmon and forwarders, and wire in threat-intel enrichment so events arrive with context, not just noise.

Author Sigma-based detection rules mapped to ATT&CK techniques, tune out false positives against your real traffic, and document a triage runbook for every alert class.

Contain and eradicate confirmed incidents, write the post-incident report, and deliver monthly coverage reports so you can watch detection measurably improve.

Enumerate the real exposure: open ports, DNS records, TLS posture, third-party scripts, and CI/CD secrets. Nothing gets hardened until it's mapped.

Apply CIS-benchmark hardening to the OS and web server, enforce key-only SSH and least-privilege access, and lock down every service that doesn't need to be public.

Enforce TLS 1.3 with HSTS, deploy WAF rules and rate limiting at the edge, and put DDoS mitigation in front of the origin before launch — not after the first attack.

Re-scan with independent tooling, close what's found, and codify the entire hardened state in Terraform so it's reproducible — with documentation your team can actually operate.

Run a full technical crawl to see exactly what search engines see: indexation leaks, redirect chains, orphaned pages, duplicate content, and anything exposed that shouldn't be.

Rebuild the robots and sitemap strategy, enforce canonical URLs, implement structured data, and close every indexation leak — staging domains included.

Refactor the render path, image pipeline, and caching strategy until every Core Web Vital is in the green on real mobile devices, not just lab runs.

Wire Search Console and Lighthouse checks into an ongoing report so gains hold, regressions get caught early, and nothing quietly re-leaks.

Sit with the actual process — the tickets, logs, or CRM entries eating your team's hours — and define exactly what data the agent may touch and what permissions it needs. Nothing more.

Scoped tokens, field-level redaction, prompt-injection defenses, and output validation — designed before the first line of agent logic is written.

Python and FastAPI service with vault-backed secrets, containerized deployment, and API integrations that authenticate as the user — never as a god-mode service account.

Full audit logging and OpenTelemetry tracing on every action, plus measured accuracy reviews so the agent improves on evidence, not vibes.