Your Security Operations Centre.
On African soil.
Answering in 15 minutes.
OpenCyOps is a fully managed SOC for African regulated mid-market businesses. We detect threats in minutes, contain them in hours, and publish our SLAs so you can hold us to them. Built on a transparent open-source stack. Operated by named African operators. Your data never leaves the continent.
Incumbents hide their SLAs. We publish ours.
Incumbents host your data offshore. We don't. Incumbents route you through anonymous queues. We don't. Here's what we sign for, every time.
P1 acknowledgement
Every package. Published in every contract. Measured every quarter.
Data resident in South Africa
POPIA §72 aligned by architecture. No offshore routing. No data-transfer ambiguity.
Your operator. Not a queue.
Every client has a named L2 analyst lead. You know their name. You have their phone number.
Four pillars. One defensible position.
The only SOC built for African regulated businesses.
Open-Stack Economics
Transparent cost. No per-EPS surcharges. Zero licence lock-in. Your security costs don't rise with your growth.
African Data Residency
In-country PoPs in Johannesburg and Cape Town. POPIA §72 aligned. Sovereignty by architecture, not by promise.
Compliance-as-Outcome
Audit-ready evidence bundles mapped to POPIA, PCI DSS, ISO 27001 and King IV. Not raw logs. Outcomes.
Human-Grade Response
Named operator. Direct phone number. Real relationship. This is not an offshore ticket factory.
Named leadership. Direct accountability.
This is not an offshore ticket queue. The operators accountable for your outcome are named, reachable, and in the work.
Ralph Albert Vraagom
Thammy Shipalana
Njabulo Mhlongo
Response within 4 business hours. No bot. No form-to-void.
The threat landscape has moved. The incumbent model hasn't.
POPIA enforcement is real.
The Information Regulator has issued material penalties and enforcement notices in 2024–2025. Audit trails, cross-border transfer controls, and breach response are no longer optional — they are statutory.
Mid-market is the new target.
South African ransomware victimology has shifted from large enterprise to 200–2,000 employee businesses — the exact segment incumbent MSSPs are structurally too expensive to serve.
Licence economics are broken.
Per-EPS SIEM pricing means your security costs rise with your growth. Open-stack economics decouple the two — you scale, your SOC cost does not.
Four packages. Outcome-tiered.
We price by risk tier, not by endpoint or EPS. You should not be punished for growing.
CyOps Essentials
You pass your compliance audit. Your board gets a quarterly risk report. You stop guessing whether you're exposed.
CyOps Professional
You sleep at night. Your incidents are contained before they hit the news. Your compliance evidence is audit-ready, always.
CyOps Enterprise
Your SOC becomes a boardroom asset. You measure cyber risk the way the CFO measures financial risk.
CyOps Advisory
You build the security programme the regulator expects, with someone who's built them before.
Operational transparency. From Day 1.
Incumbents don't show you this. We publish it because we sign for it.
Day 1 — Kick-off
You meet your named L2 analyst. Scope confirmed. MSA signed.
Day 7 — Baseline
Every endpoint, every log source, every identity boundary catalogued.
Day 14 — Assessment
Prioritised risk roadmap — with or without us. Yours to keep, either way.
Day 30 — SIEM live
First executive report published. First incident runbook tested.
Day 60 — 24/7
Full monitoring live. Compliance evidence bundle v1 generated.
Day 90 — Board review
Measurable reduction in risk posture score. Year-1 roadmap locked.
Send Thammy a line.
Or Njabulo.
You'll hear back today.
No bot. No form-to-void. No "our sales team will reach out in 5–7 business days." Named leadership. Direct accountability. Four business hours.