The Managed Security Service Provider That Also Runs Your IT
Book a free IT and security assessment
BastionX, a New York City-based managed service provider, is a managed security service provider that also runs your IT. The same team that runs your help desk, devices, Microsoft 365 and network also monitors your security around the clock and maintains your compliance controls. You have one contract and one team to call when something breaks.
- A 24/7 SOC that we run ourselves
- Managed IT support, from help desk to Intune and Apple device management
- Compliance controls implemented and maintained for HIPAA, NYDFS Part 500, GLBA and more
- A Bastion Core security device included at no additional cost when you choose managed IT and cybersecurity together
Why One Team Instead of Two Vendors
A common setup is an IT provider plus a separate security provider. Each does its part, but work that touches both tends to stall. A security alert that needs a firewall change waits in one vendor's queue while the change sits in another's. A new laptop goes out without the security agent because neither vendor owned that step.
At BastionX, the team that investigates an alert also manages the systems behind it, so the fix doesn't wait on a second vendor and the record of it stays in one place. You also aren't paying two providers to learn the same environment.
An MSP (managed service provider) generally focuses on IT operations: support, administration, patching and backup. An MSSP (managed security service provider) focuses on security monitoring, investigation and response. In practice the two overlap. What matters is which systems a provider covers, who watches them after hours and who can act on an alert. BastionX puts those answers in writing before work starts.
Managed IT Support
Our managed IT services for small and mid-sized businesses cover the day-to-day IT work your staff depend on:
- Help desk: a managed help desk for users, with tickets tracked against agreed response times.
- Microsoft 365: Office 365 managed services covering licensing, security settings, SharePoint and Teams.
- Device management: MDM services for Windows and Apple fleets, including Intune migration and Jamf managed services for Mac.
- Backup and recovery: disaster recovery as a service, including restore testing.
- Monitoring: managed NOC services that watch availability and performance.
- Hardware and onsite work: hardware procurement, structured cabling services and wireless.
If you have an in-house IT team, we can work alongside it through co-managed IT, taking on monitoring, security or project work while your staff keep the rest.
Managed Cybersecurity Services
BastionX runs its own 24/7 U.S.-based SOC, backed by a self-hosted SIEM. Our managed cybersecurity services include:
- Security operations: SOC as a service and managed SIEM, collecting and correlating logs from the systems in scope and investigating alerts under agreed procedures.
- Endpoint protection: managed EDR built on SentinelOne, deployed and managed on the endpoints covered by your engagement.
- Vulnerability management: vulnerability assessment services that combine scan results with asset information to decide what gets fixed first.
- Network and identity: network security services, IAM services and Zero Trust network access.
- Response: incident response retainers and ransomware protection.
- People: phishing simulation and security awareness training.
- Penetration testing: penetration testing services are performed by our partner PKF O'Connor Davies (PKFOD) on referral. BastionX can coordinate and implement the agreed remediation.
- Leadership: vCISO services for organizations that need security program oversight without a full-time hire.
Remote access runs on CipherNet, BastionX's own fork of an open source WireGuard mesh platform, which we maintain, host and operate. CipherNet connects users, sites and devices with access policies based on identity and device security rather than network location. Client connections generally work without manually configuring inbound port forwarding at client sites, though outbound connectivity and hosting arrangements depend on the deployment.
Where automation fits
Automation groups related alerts, adds context and helps analysts decide what to investigate first. Approved playbooks can isolate an endpoint or disable an account as soon as a threat is confirmed. Anything disruptive needs a person to approve it first, and analysts make the investigation and response decisions. We tune and review detection rules regularly, since every tool misses some threats and flags some harmless activity.
Compliance Controls We Implement and Maintain
BastionX implements and maintains the security controls your regulations require. Assessment, audit and certification are performed by independent assessors or our partners, and your organization keeps responsibility for its obligations. If your auditor has handed you a list of findings, that list is where we start.
Our compliance as a service covers:
- HIPAA compliant IT services for healthcare organizations
- 23 NYCRR 500 for New York financial firms
- GLBA and FTC Safeguards Rule controls for financial institutions
- PCI DSS compliance services
- NIST CSF and CIS 18 controls
- SOC 2 Type 2 controls and evidence for your CPA firm's examination
- ISO 27001 compliance as lead implementer
- CMMC compliance services, delivered with our assessment partner
Between audits, we monitor supported controls, collect evidence for the agreed scope and track findings to closure with named owners. Organized records reduce last-minute preparation, though the outcome of any assessment still depends on your controls and the evidence behind them.
Cloud, Strategy and AI Services
- AI automation consulting covering AI governance and workflow automation, including agentic AI for agent-based workflows
- Managed cloud services and migrations across Azure, AWS and Google Cloud
- IT strategy consulting and virtual CIO services for technology planning and budgeting
- HashiCorp Vault implementation for development teams managing secrets at scale
Who We Work With
We work with growing businesses, nonprofits and regulated organizations that want one long-term partner for their whole environment. That includes healthcare IT support, financial services cybersecurity, IT services for law firms, nonprofit IT services, school IT services, retail IT services, utility cybersecurity and public sector cybersecurity.
BastionX supports businesses across New York City, New Jersey, Long Island, and Philadelphia. Most services are delivered remotely, with onsite support provided under the agreed service scope.
We manage whole environments and don't take on one-off fixes, because we need to know your infrastructure well to support and secure it. Every engagement starts with an assessment and a defined scope.
The Team and the Track Record
BastionX's security and technical delivery are led by Rashid Ahmed, CISSP, our CISO and CTO, who has more than 25 years in technology and security. He spent 17 years at Payomatic, a consumer financial services business, rising to CISO, and later served as CISO at Velocity Group USA and LutherSales. Years of working with auditors in regulated financial services shaped how the team works. We agree the requirements and the owners first, then put the controls in place and keep the evidence auditors ask for.
Our Payomatic case study shows that approach in a regulated financial services environment, including PCI DSS and NYDFS Part 500 controls.
What the First 30 Days Look Like
During the first 30 days, we work with your team to understand your environment, take over support and identify what needs attention first. We review user access, devices, Microsoft 365, network configuration, backups and existing security controls. Then we put the agreed monitoring and patching in place and build a prioritized improvement plan with clear owners.
You receive an inventory of systems and devices, an access-control summary covering administrative privileges and authentication gaps, and an action plan for the risks we find. Ongoing reports cover security alerts, patching status, vulnerabilities and support activity. For leadership and board discussions, we provide a plain-language summary of key risks, completed work, open decisions and next steps.
If you're moving from another provider, we plan the transition with you, working with the outgoing provider to arrange access and documentation handover. Scope, timing and any transition fees follow your agreement.
Initial onboarding typically takes two to four weeks, depending on the size of your environment and access to your outgoing provider. Larger projects, such as cloud migrations or identity modernization, follow their own schedule with agreed milestones.
Frequently Asked Questions
What is a managed security service provider?
A managed security service provider (MSSP) is an outside company that monitors, investigates and responds to security threats for an organization. Typical services include security monitoring, alert investigation, endpoint protection, vulnerability management and reporting. Coverage hours and response authority vary by provider, so they should be defined in the agreement.
What is the difference between an MSP and an MSSP?
An MSP (managed service provider) generally runs IT operations such as help desk support, administration, patching and backup. An MSSP specializes in security monitoring and response. Many providers offer some of both. BastionX delivers both from one team, so IT changes and security findings are handled in the same workflow.
Do you replace our in-house IT team?
Not necessarily. Through co-managed IT, BastionX can take on security monitoring, help desk overflow or project work while your staff keep ownership of the rest. Responsibilities are written into the engagement so both teams know who handles what.
What does 24/7 security monitoring cover?
BastionX's SOC collects and correlates logs from the systems in scope around the clock, investigates alerts and escalates under agreed procedures. Approved response actions, such as isolating an endpoint, can run immediately. The systems covered and the actions we're authorized to take are defined before monitoring starts.
Can a managed security service provider make us compliant?
No provider can establish compliance on your behalf. BastionX implements and maintains the required controls, collects technical evidence and supports remediation. Your organization remains responsible for its obligations, and independent assessors or auditors perform the reviews. For example, a SOC 2 examination is performed by an independent CPA firm.
What is Zero Trust?
Zero Trust is a security approach that doesn't grant trust based on network location or device ownership alone. Every access request is authenticated and authorized using identity, device security and other available context, as described in NIST SP 800-207. BastionX applies it through identity policies and CipherNet. VPNs can still be part of a sound design when they're combined with strong authentication and access restrictions.
What is the security device, and when is it included?
The Bastion Core is a security device installed in your environment that runs automated internal vulnerability scanning. When configured, it can also act as a local relay, forwarding data from supported devices to the SIEM over an encrypted connection, which helps with devices that can't send encrypted logs directly. If you choose managed IT and cybersecurity together, the device is included at no additional cost, as specified in your proposal.
How is pricing determined?
Pricing depends on the number of devices, your environment and the scope of services. After the assessment, you receive a proposal that sets out what's included and anything quoted separately.
Start With a Free IT and Security Assessment
Tell us how many users and devices you have, which platforms and cloud services you run, and which regulations apply to you. We'll review your current IT and security setup, point out the gaps that matter most and send a proposal that spells out what BastionX would run, monitor and maintain.
If you choose managed IT and cybersecurity together, your Bastion Core security device is included at no additional cost, as specified in your proposal.
