We were there when a virus was just noise.

Our clients run from SMMEs with one server and a handful of staff to enterprise sites across several locations.

What has changed is the standard we run it to. The same team that fixes the laptop is the team that patches it, monitors it and can show you where it sits against the NIST Cybersecurity Framework 2.0. Security is not a separate product we sell you afterwards. It is how the support is done.

We started in the early days of small-business IT in South Africa, and we have been in the room for every shift since: when a virus was mischief rather than malice, when attacks started costing real money, and now, when the people being targeted are your directors and the person who can approve a payment.

Twenty-eight years does not make us right about everything. It does mean we have seen what happens to businesses that waited, and we would rather you did not.

LANTEK was started in 1998 by a Cisco and Microsoft certified engineer. He still owns it, he still reads the reports that go out to clients, and he is the reason this page has certificates on it instead of photographs.

Somewhere along the way the job changed. The calls stopped being about a machine that would not start and became about money that had left the account. So he went and qualified in cyber security at the University of Cape Town, because he was not going to sell a client something he could not read himself. Twenty-eight years, one discipline, one pair of hands, and no layer of account managers between you and the person who can answer the question.

The people he has brought in since are cut the same way, and it is worth saying plainly what they hold. Security is led by a CISSP-certified professional, which is the qualification a client’s security questionnaire actually asks about, and it is not a weekend course. You may not sit the examination until you have five years of documented, paid work behind you. Another certified professional has to endorse you. You keep it by proving every year that you are still learning, and you lose it if you stop.

When something needs testing rather than discussing, that is done in house by a degree-qualified specialist holding eCPPT and eCTHP. Those are practical qualifications. There is no multiple choice section: you are given an environment and asked to get into it, and you either do or you do not. Reading what the monitoring produces afterwards is its own discipline and its own certification, CompTIA CySA+, which is about telling the difference between the thousand things that happen on a network every night and the one that matters.

Underneath all of that are the engineers who build and run the thing in the first place, carrying enterprise routing, security core and expert-level datacom certification, with advanced wireless and SD-WAN work alongside it. They are not a separate security team. Segmentation, which is what stops one compromised laptop reaching everything else you own, is a network job long before it is a security product. The same people hold Microsoft 365, Teams administration and Azure certification, and specialist certification in backup, disaster recovery, email security and endpoint detection, which between them cover most of what your business touches in a day.

We could give you their names. We would rather give you the certificates. A name and a job title on a web page tell you nothing you can check. A certificate tells you what somebody had to prove, and to whom. Every one of them is on file, and if you want to see any of it, ask, and we will put it in front of you.

Certifications are only useful if they are arranged into something. Ours are arranged around six layers, and the whole of it maps to the NIST Cybersecurity Framework 2.0, which is the internationally recognised yardstick for the reasonable measures POPIA requires.

• Device
• Identity and email
• Network
• The people who click things
• Somebody actually watching
• The paperwork that proves it was all in place

Security is not a product we bolt on at the end. It is six layers of control, built into your environment from the first day.

We are trying to make sure that the ordinary attack, which is the one that actually happens, does not work. Almost everything that hurts a smaller South African business is preventable with controls that already exist and are simply not switched on. Our job is to switch them on, watch them, and prove they were on when somebody asks.

When something breaks, somebody answers the phone, and it is somebody who already knows your setup. That was true in 1998 and it is the only thing on this page that has not needed updating since.

Ballito, KwaZulu-Natal, and Sandton, Gauteng. Monitoring, patching, security operations and most support are delivered remotely, so distance is rarely the constraint. When somebody needs to be on site, they come from whichever office is closer.