Cybersecurity in New York, built for growing companies.
Defensible is a New York-based cybersecurity and IT firm founded by former Stroz Friedberg leaders. We help Manhattan-headquartered SaaS, financial-services, and private-equity-backed companies build security programs that stand up to regulators, insurers, and acquirers — with senior consultants on-site in NYC when the work requires it.
Trusted by New York SaaS, private equity, and non-profit teams.
Manhattan companies are attacked differently.
New York's concentration of finance, media, legal, and venture-backed SaaS makes it one of the most targeted markets in the country. Business email compromise, ransomware against law firms and PE-backed portfolios, and NYDFS Part 500 enforcement all hit local teams harder than the national average.
Defensible's New York practice is built around that reality. We handle regulator communication, insurer questionnaires, and board updates alongside the technical work — because Manhattan boards expect both.
NYDFS Part 500 & 500.17
Financial services firms and their vendors face annual CISO certification, 72-hour breach notice, and third-party risk requirements.
BEC in law & finance
Wire-transfer fraud targeting NYC law firms and PE deal teams remains the top loss driver reported to the FBI.
Insurance tightening
New York carriers are rejecting renewals without MFA, EDR, immutable backups, and documented IR plans.
SEC cyber disclosure
Public and pre-IPO issuers in NYC must disclose material incidents within four business days under the 2023 SEC rule.
Vendor & PE diligence
Manhattan-based acquirers and enterprise buyers now require SIG, CAIQ, and evidence packages before signing.
Hybrid Manhattan offices
Coworking, WeWork, and hybrid Midtown/FiDi footprints expand the attack surface beyond a single perimeter.
Senior consultants. On-site in Manhattan when it matters.
We keep our New York bench small on purpose. Every engagement is led by a senior consultant who can sit with your team in the Financial District, Midtown, or Brooklyn — not routed through a junior pool.
On-site incident response and forensics anywhere in the five boroughs, Westchester, and northern NJ.
NYDFS, SEC, HIPAA, and state AG notification workflows built into every retainer.
We speak the language of the NY-based carriers and brokers your board already uses.
Diligence, integration, and Day 1 cutovers on the timelines PE and M&A teams actually run.
Everything a growing NYC company needs from a security partner.
Delivered from our 48 Wall Street office and remotely across the tri-state area.
Cybersecurity & vCISO
Senior security leadership without a full-time hire.
- Fractional / vCISO — Board reporting, program strategy, and regulator interaction led from NYC.
- NYDFS Part 500 readiness — Gap assessment, remediation, and annual CISO certification support.
- SOC 2 & ISO 27001 — End-to-end program build for SaaS companies selling into enterprise.
Incident response & DFIR
Founded by former Stroz Friedberg senior leaders — the New York firm that defined modern DFIR.
- 24/7 IR retainer — Manhattan-based responders with pre-negotiated SLAs.
- BEC investigations — Email forensics, wire recovery coordination, and regulator notification.
- Ransomware — Containment, negotiation support, and post-breach hardening.
Assessments & pen testing
Prove the program works — to your board, insurer, and buyers.
- Penetration testing — External, internal, web app, and cloud pen tests scoped to NY compliance needs.
- Cyber insurance readiness — Close the control gaps your carrier is flagging before renewal.
- M&A cyber due diligence — Pre-close and post-close diligence for NYC-based PE and strategic buyers.
Managed IT & MSSP
IT and security operations for growing NY teams.
- Managed IT — Endpoint, identity, and productivity stack for Manhattan and hybrid offices.
- Managed detection & response — 24/7 MDR/MSSP monitoring with a New York SOC escalation path.
- Identity & email security — Microsoft 365 and Google Workspace hardening tuned for NYDFS and SEC expectations.
Built for the sectors that anchor NYC's economy.
Every industry has its own regulators, buyers, and attackers. We know how to talk to yours.
Series A–C companies selling into enterprise. SOC 2, vendor security reviews, and board-ready reporting.
Portfolio-level cyber diligence, standardization, and integration across NYC-based funds.
NYDFS Part 500, SEC OCIE, and FINRA expectations for RIAs, hedge funds, and fintechs.
Donor and grant data protection for the mission-driven organizations headquartered in NYC.
A five-step engagement, from intro to steady state.
Predictable, senior-led, and scoped to your stage of growth.
- STEP 1Intro call
30 minutes to understand your business, regulators, and risk tolerance.
- STEP 2On-site or virtual scoping
We can meet at 48 Wall Street or your NYC office.
- STEP 3Assessment
A written baseline you can share with your board, insurer, or acquirer.
- STEP 4Roadmap
Prioritized remediation with owners, timelines, and cost.
- STEP 5Ongoing partnership
vCISO, managed IT, MDR, or IR retainer — sized to your stage.
"I've worked with Defensible for years, and they're in a different league from other MSPs and security providers."
— Max Everett, Former CIO, The White House and U.S. Department of Energy; CISO, Shaw Industries
Frequently Asked Questions
Where is Defensible's New York office?+
Our New York office is at 48 Wall Street, Suite 1100, New York, NY 10005 — in the Financial District, minutes from the Wall Street and Broad Street subway stations. Senior consultants are available on-site across Manhattan, Brooklyn, Queens, and northern New Jersey.
Do you help with NYDFS Part 500 compliance?+
Yes. We run gap assessments against 23 NYCRR 500, remediate deficient controls, and support the annual CISO certification. We also help covered entities meet the 72-hour cybersecurity event notification requirement.
Can you respond to an active incident in New York?+
Yes. Our incident response practice was founded by former Stroz Friedberg senior leaders and can deploy on-site anywhere in the five boroughs, Westchester, Long Island, and northern New Jersey. Call (646) 349-4252 for an active incident.
Do you work with New York-based cyber insurance carriers and brokers?+
Yes. We routinely close control gaps that NYC-market carriers flag on renewal — MFA everywhere, EDR coverage, immutable backups, tested IR plans — and we produce the evidence brokers need to place coverage.
How quickly can you start in NYC?+
Retainer and IR engagements typically kick off within 5–10 business days. Emergency incident response is available 24/7.
What are your hours?+
Our New York office is staffed Monday through Friday, 9:00 AM to 6:00 PM ET. Incident response is 24/7.
Talk to a Defensible consultant in New York.
Book a scoping call and we'll show you how a New York-based security team, founded by the people who built Stroz Friedberg, would approach your program.