Sage cloud products are subject to 24/7 security monitoring and threat detection by the Sage cyberdefense operations team.

At Sage, scale means we invest millions of dollars in improving our defences and threat detection capabilities, so you don't have to. We invest in leading security technologies and a global team of skilled security specialists, who maintain their edge and learn continuously through red team exercises, bug bounties and working closely with industry and government experts.

This means Sage customers can drastically reduce their operational risks with a fraction of the investment they would otherwise need.

How an organization responds to potential cyberattacks is as critical as the preventative measures they take. That's why Sage places the utmost importance on the effectiveness of our response and recovery capabilities and procedures.

Sage follows established incident response frameworks such as NIST and PICERL, maintaining effective response plans and playbooks, testing them through regular incident exercises and simulations, and using this learning to drive continuous improvement.

Our global security and response teams are augmented by world-leading specialists in data privacy, digital forensics, and crisis response, providing 24-hour coverage, 365 days a year.

If you have a security concern regarding Sage products or services, please contact us.

We continuously collect vast volumes of data and logs from our cloud products, security solutions, and cloud hosting services.

This data is aggregated, enriched, and correlated with threat intelligence, business insights, and other data sources to provide near real-time threat alerts, enabling our security and operations teams to detect and respond to potential threats, anomalies, or suspicious events as they occur.

We use a high degree of automation to increase effectiveness and quality of data collection and analysis, to minimise false positives and ensure our security and operations teams are focused on responding to real threats.

Vulnerability Management is a critical part of maintaining secure systems. We invest heavily in a range of methods and solutions to identify vulnerabilities as soon as possible across our technology and fix them quickly.

We take this activity very seriously, ensuring our cloud customers benefit from systems that are secure by design and always up-to-date. Some of our vulnerability identification solutions include red team exercises, bug bounties, threat assessments, penetration testing, static code analysis, dependency checks, and platform vulnerability scans.

Sage adheres to international standards for responsible vulnerability disclosure and offers a streamlined method for the community to report security concerns to Sage. Security concerns can also be reported to [email protected].

Security patches typically involve code changes aimed at addressing specific vulnerabilities or bugs identified in the software.

Maintaining security and stability requires keeping software applications patched. Hackers frequently seek vulnerabilities in software to exploit, gaining access to systems or networks. By ensuring our software remains patched and up-to-date, the risk of security breaches and other IT-related problems can be reduced.

Alongside patching our software dependencies, we regularly apply patches to our cloud products, incorporating bug fixes and performance enhancements. These updates are deployed seamlessly, without any disruption to our customers

Penetration testing is a well-understood way of probing systems to validate controls and identify weaknesses before attackers find them.

To compliment our comprehensive penetration testing program, we use sophisticated "red teaming" techniques to perform in-depth, objective-led tests that mimic real attacker capabilities, tactics, and goals. The Sage expert red team performs these tests, sometimes with the support of external specialists.

We believe the best results come through close collaboration between "blue" (defensive) teams and our red team, conducting ongoing testing with a rapid feedback loop so that threat detection and security controls are continuously iterated and improved. In the security industry, this approach is known as "purple teaming."