Frequently asked questions

Three layers under one monthly per-user fee. Cyber-security baseline — identity, endpoint and email protection run on your Microsoft 365 tenant, patching, backup monitoring and security reporting. Routine IT support — a remote service desk for your users, endpoint monitoring, Microsoft 365 administration, joiner/leaver handling and vendor coordination. Project work — one-time professional services (migrations, office moves, new infrastructure) quoted separately as a fixed statement of work. Every tool we need to run the service — ticketing system, user self-service portal, endpoint monitoring agents and remote-support tooling — is included in the package price, licences and all. See what's included in every plan →

Copy link Managed Service Package

Included: all Brocent-side tooling — ticketing, the user portal, endpoint monitoring and remote-support software. Assumed: you already run Microsoft 365; we build the security baseline on the features your subscription already carries (Defender, Intune, Entra ID, attack simulation), so those licences stay yours. If you are not on Microsoft 365 yet, tell us your current subscription and we will scope from there. Charged separately: one-time assessment and hardening services — the Microsoft 365 Security Audit, Security Patch Management programme, Penetration Testing and similar — each has its own published price. Compare the security services →

Copy link Managed Service Package

Microsoft Defender for Business, which is already part of Microsoft 365 Business Premium — for most SMEs it is the best buy against value compared with a separate EDR licence, and it integrates with the identity and email controls we manage for you. Brocent monitors and tunes it as part of the package. A separate EDR/MDR platform only makes sense where a regulator, auditor or investor specifically requires one.

Copy link Managed Service Package

SOC/SIEM is a separate Brocent offering delivered on our internal SOC platform, and it is not cheap — so the real question is your expectation versus budget. If most of your estate lives in Microsoft 365, our honest advice is not to buy a SOC: use the built-in security reporting, alerting and Secure Score workflow in the Microsoft platform, which we operate for you inside the package. Routine security incidents are handled by the service desk under the normal SLA; major-incident response and forensic investigation are scoped as a separate engagement.

Copy link Managed Service Package

Day-to-day operation of your existing backup is included — monitoring jobs, chasing failures, running restores. Designing and implementing new backup or DR infrastructure is a separate project, and it starts with understanding how it works today: what is backed up, where it sits, and the recovery point and recovery time you actually need.

Copy link Managed Service Package

Phishing simulations are part of the Microsoft 365 service and, for package clients, we schedule them as a monthly job using Attack Simulation Training. For a full awareness curriculum with tracked completion we usually point clients to KnowBe4 (a separate licence), or to our own managed Security Awareness Starter if you would rather we ran the whole programme. See Security Awareness Starter →

Copy link Managed Service Package

Isolate them. External finders, advisers and contractors on devices you do not manage should work in a separate, purpose-built environment — a guest tenant, a shared workspace or browser-only guest access with conditional access blocking downloads and sync — rather than being mixed into your internal production systems. The right design depends on what they actually need to reach, so we scope it in discovery before recommending a pattern.

Copy link Managed Service Package

Per user, per month, at a published rate for each market — the live figures and a quote builder are on the Managed IT Support page. Entry-level (Startup tier) pricing starts from HK$855.14 per user per month in Hong Kong, RMB¥177.92 in mainland China and US$89.10 in the United States; larger teams move up to the Established and Growth tiers. Remote support is included in every tier — onsite visits are the one thing billed on top (see below). See current per-market pricing →

Copy link Managed Service Package

No — when the scope is taking over and running your routine support, the takeover (documentation, agent roll-out, portal set-up, user onboarding) is part of the package and we do not charge an onboarding fee. The exception is implementing new technology — a Microsoft 365 migration, a new network, a backup platform — which is priced as a project with a fixed statement of work.

Copy link Managed Service Package

Onsite visits are billed hourly on top of the package. For package clients the indicative rate is US$45 per hour in mainland China, US$60 in Hong Kong and US$85 in the United States, with a minimum of 2 hours per visit. Outside office hours the rate is uplifted by 50%, and by 100% on weekends and public holidays. If you expect regular visits, pre-purchasing bulk hours through Token Service works out cheaper (see the next question). Compare with ad-hoc dispatch rates →

Copy link Managed Service Package

Yes. A Token Service top-up starts at a minimum of 20 hours, is valid for 12 months, and can be drawn down across your offices for onsite, remote or project work at a lower effective hourly rate than per-visit billing. How Token Service works →

Copy link Managed Service Package

Yes, across all three. Procurement: we source locally in each market and charge an 8% administrative fee on hardware and software supply — that is the only margin. Configuration and deployment: new-joiner builds and leaver wipes are done remotely and are included in the package; where the work must physically happen onsite, a standard 3-hour onsite service fee applies. Lifecycle: the asset register, warranty tracking, refresh planning and end-of-life disposal are handled inside the package. See onsite IT dispatch →

Copy link Managed Service Package

With local teams in Guangzhou and Hong Kong, and a centralised service desk staffed in China, Hong Kong, India and Malaysia that runs follow-the-sun — so a US user calling during US hours reaches an engineer on shift, not a voicemail. The US is covered remotely by that desk; we do not keep local staff there, but ad-hoc onsite work is arranged through long-standing partners when a visit is genuinely needed. See coverage by country →

Copy link Managed Service Package

Mainland China and Hong Kong: Brocent employees, onsite and remote. The service desk in China, Hong Kong, India and Malaysia: Brocent employees. United States: remote support by Brocent employees; onsite visits only, when required, are delivered by vetted partners working under a Brocent ticket and Brocent's SLA — you always deal with us, never with the partner directly.

Copy link Managed Service Package

The standard service window is 8×5 — eight business hours a day, Monday to Friday — with a 30-minute first response on standard requests. Critical (P1/P2) incidents follow the faster priority-based commitments on our SLA page. Outside office hours, on weekends and on public holidays the response time may extend to 2 hours under the emergency extension. See response times by priority →

Copy link Managed Service Package

Yes — this is one of our advantages, because it is part of the professional and cyber-security-as-a-service layer rather than a bolt-on. We maintain the policy set, produce control evidence and answer questionnaires alongside you in the scenarios that trigger them: M&A due diligence, Hong Kong regulator and government compliance, investor operational due diligence (ODD/DDQ) and external audits. The quickest way to see the framework we work to is the free self-assessment. Run the free IT security self-assessment →

Copy link Managed Service Package

We rate it medium-to-high. The majority of our clients run cross-border operations, so handling Hong Kong's PDPO, mainland China's PIPL and US privacy and audit expectations is routine work for us rather than a special project. We are not a law firm — we implement and evidence the controls, and work with your counsel on interpretation.

Copy link Managed Service Package

Natively. Several core team members are originally from mainland China and work with the local policy and practice day to day: personal-data classification and localisation, the cross-border transfer mechanisms (standard contract filing or security assessment, depending on volume), and tenant and region design in Microsoft 365 so that data lands where it is supposed to.

Copy link Managed Service Package

Minimum one year, with 30 days' written notice to terminate. Contracts renew on the agreed terms unless notice is given. See credit terms, invoicing and currencies →

Copy link Managed Service Package

We hand over according to your transition plan: documentation, credentials (they are yours throughout), configuration exports and knowledge-transfer sessions with the incoming MSP or MSSP. There is no lock-in — the environment, licences and data stay under your ownership.

Copy link Managed Service Package

Brocent provides IT services across 100+ countries globally. Direct field delivery is available in 12+ countries including Singapore, Hong Kong, China (mainland), Japan, South Korea, Malaysia, Thailand, Vietnam, India, Philippines, Indonesia, and Poland. Remote managed services and helpdesk are available worldwide.

Yes. We manage and support cloud platforms including Microsoft Azure, Microsoft 365, Google Workspace, Alibaba Cloud, Tencent Cloud, AWS, and multi-cloud hybrid environments. Services include design, migration, implementation, and ongoing 24×7 management.

Yes. Brocent operates 50+ warehouse locations globally for staging, spare parts storage, and hardware logistics. Warehouses are operational in China (mainland), Hong Kong, Singapore, Malaysia, Japan, Thailand, and India. All hardware warehouses support 24×7 parts availability.

Our core services include: On-site IT support (desktop, network, server), Managed IT Services (full outsourced IT department), Cloud solutions, Cybersecurity, Professional IT services (office setup, relocation, Wi-Fi survey, DC deployment), Hardware maintenance & ITAD, and Token Service (flexible pay-as-you-go).

Yes, the majority of our engineers communicate in English. Our multilingual team also covers Mandarin, Cantonese, Japanese, Korean, Thai, Vietnamese, and other languages — matched to the markets they serve.

No. BCS Warehouse & Stock Manager is not sold or licensed as a standalone product. It is the operational tool layer of Brocent's warehousing service: when Brocent operates warehousing for you under Warehouse as a Service, the WMS — including its supplier and customer portals — is included as part of that service. See Warehouse as a Service →

Copy link Service Coverage & Scope

Access is provisioned by Brocent as part of warehouse service onboarding. Customers receive read-only customer-portal accounts covering their own inventory and delivery history. Suppliers operating under a WMS contract receive supplier-portal accounts scoped strictly to their authorized warehouses — never another supplier's data.

Copy link Service Coverage & Scope

Yes, scoped per engagement. The platform already runs token-based authentication for its external portals, fine-grained permission scoping for integration accounts, and a live courier-tracking API. Webhook-style event notifications (for example inbound received or outbound shipped) are proven elsewhere on the platform. Integration design — push vs. pull, real-time vs. batch, order-level vs. serial-number granularity, API keys and rate limits — is agreed in a discovery call. See the WMS integration walkthrough →

Copy link Service Coverage & Scope

Brocent offers tailored SLAs with three standard components: (1) Service Desk First Response Time, (2) Field Service Response Time, and (3) Problem Resolution Time. Standard SLAs include P1 first response ≤ 15 minutes, P2 ≤ 1 hour, P3 ≤ 4 business hours. 4-hour on-site response is available in major cities. See our SLA page for full details.

Brocent commits to penalty and compensation provisions for any SLA breach, as documented in the Master Service Agreement. We take accountability seriously and report SLA performance monthly.

Brocent offers 30-day credit terms for new clients. Clients with a strong 6-month payment track record may be eligible for extended terms of 45–60 days.

Yes. Brocent is a certified VAT taxpayer and can issue VAT invoices. Applicable VAT rates by jurisdiction: China (mainland) — 6% IT services, 13% hardware; Singapore — 9% GST; Japan — 10%. Hong Kong has no VAT.

The minimum period for a dedicated FTE engineer is one month. We also support short-term engagement under a Master Service Agreement.

The minimum charge for remote support is 0.5 hours.

Indicative 2026 business-hours on-site rates (per mid-level engineer, same-business-day response), fully loaded — first hour / additional hour / full day: mainland China USD 79 / 71 / 315; Hong Kong USD 94 / 79 / 440; Singapore USD 94 / 71 / 370; Japan USD 142 / 110 / 629; Taiwan USD 102 / 79 / 409; India USD 35 / 19 / 71. Minimum 2 hours per visit, with a 10-minute tolerance per increment thereafter. After-hours: evening/night ×1.5, weekend/public holiday ×2; rates also scale by engineer skill level (L1–L3) and SLA tier. These fully-loaded rates already absorb local cost-of-living, bilingual and qualified engineers, training and resource-qualification effort, cross-border banking, FX and double-taxation handling, credit-term financing cost, and 24×7 service-desk coordination overhead — and fall significantly at higher service volumes as that management overhead is shared across more work. Figures are indicative only; contact the Brocent sales team for a firm quote.

Yes. We support contracts in both English and Chinese, and billing in USD, SGD, HKD, CNY, JPY, and other major currencies depending on the contracting entity.

Yes. IT service contracts typically include auto-renewal based on the agreed terms. Clients may suspend or change the service duration with one month's advance notice.

Our published Managed IT rates already run 20–70% below typical published Hong Kong and Singapore market ranges. For Enterprise and other custom-scoped deals, show us a comparable like-for-like quote from a licensed regional MSP and we'll beat it by at least 10%. See current plan pricing.

Token Service is a pre-purchased hours model — one token equals one hour of on-site engineering time during business hours. You buy a block of tokens and consume them as needed — on-site or remote support, normal business hours or 24×7 emergency, across 100+ countries. Minimum charge per on-site visit is 2 tokens (2 hours). After 2 hours, each additional increment is 60 minutes with a 10-minute tolerance.

Copy link Token Service

30 days credit term upon purchase order. Tokens do not expire within the contract validity period.

The minimum purchase is 20 tokens per zone. Token validity is 12 months from the purchase date — a one-time goodwill extension is available each contract year via your account manager. Clients are notified 60 days before expiry.

Copy link Token Service

Tokens cover the full service catalogue: on-site Smart Hands dispatch, remote helpdesk (L0–L3), IMAC tasks, office buildout and relocation, WLAN surveys, hardware logistics and spare parts management, ITAD, and compliance documentation support. A single token pool applies across all service types and all covered countries.

Working hours (Mon–Fri 09:00–18:00): minimum 2 tokens, then 1 token per additional 60 minutes (10-minute tolerance). Evening (18:00–22:00): minimum 3 tokens, increments at 1.5 tokens. Weekends / late night (22:00+): minimum 4 tokens, increments at 2 tokens. Public holidays: minimum 6 tokens, increments at 3 tokens. Travel within the service city is included; remote-site surcharges apply for distances over 30 km.

Copy link Token Service

Yes — token requests follow Brocent's standard P1–P5 priority system: urgent issues (P1/P2) get a 4-hour onsite response, available 24×7 on request, while lower-priority requests are handled next business day. See the full SLA & priority definitions for all five levels.

Copy link Token Service

Yes. A single Token Service agreement covers all zones included in the purchase. Offices within the same zone share one balance; a group with offices in different markets (e.g. Hong Kong and Singapore) holds one balance per market, each billed at local rates. You can use tokens interchangeably across Hong Kong, mainland China, Singapore, Japan, Malaysia, Vietnam, India, EMEA (via Warsaw), and USCA (via New York) without separate contracts or invoices per country.

Copy link Token Service

Brocent's prepaid tokens work out to different effective hourly rates per market and pack size — see the current per-market pricing and effective per-hour rate for each pack on the Token Service pricing page.

Copy link Token Service

A Managed IT plan is a fixed monthly fee per user that includes 24/7 monitoring, help desk, patching and a security baseline — you pay for prevention and ongoing coverage. A token pack is prepaid hours you spend only when something needs fixing — no subscription, no per-user fee. As a rule of thumb: above roughly 4 tickets a month, a Managed IT plan is usually cheaper; below that, tokens are. See Managed IT pricing and Token Service pricing to compare.

Copy link Token Service

Yes — you'll receive a low-balance alert before your tokens run out, and a top-up purchase lands the same day. A weekly balance statement shows your consumption so depletion is never a surprise.

Copy link Token Service

Yes. Mainland China purchases receive a fapiao (发票); Singapore invoices itemise GST; Hong Kong invoices are issued by our HK entity.

Copy link Token Service

A dispatch rate is a straight per-visit USD price with no prepayment — you're billed after the job, at the published rate for that country. A token pack is prepaid hours bought upfront at a lower effective rate, then drawn down as you use them. For an occasional, first-time or unpredictable need, dispatch rate is usually simplest; for recurring, predictable use, tokens are usually cheaper. See Dispatch & On-site Rates and Token Service pricing to compare.

Copy link Dispatch & On-site Rates

An indicative, fully-loaded hourly rate for sending an engineer to your site — published per country for Level 1 EUC (end-user computing) support, next-business-day, standard 9×5 coverage. It covers a 1st-hour minimum plus travel within the metro/CBD area, with each additional hour billed at a lower published rate. Rates fall significantly at higher volumes.

Copy link Dispatch & On-site Rates

A full-time, bilingual engineer assigned to one site under Brocent management — for campus HQs or high-touch locations that need a permanent on-site presence rather than per-visit dispatch. Priced monthly (indicative, entry level, no backfill), and scales by skill tier (L1–L3). See current rates on the Dispatch & On-site Rates page.

Copy link Dispatch & On-site Rates

Yes, significantly. Fixed coordination and management overhead is shared across more work, so multi-site or multi-country programs price well below the single-ticket rates published on the pricing page. Multi-FTE and multi-country placements are quoted separately — ask a consultant for a volume-based quote.

Copy link Dispatch & On-site Rates

Dispatch visits are billed after the job on standard 30-day credit terms upon purchase order, itemised by ticket. Dedicated engineer (FTE) placements are invoiced monthly in advance for the coming month. Local tax invoices are issued the same way as for Token Service — a fapiao (发票) for Mainland China, GST-itemised invoices for Singapore, and Hong Kong-entity invoices for Hong Kong.

Copy link Dispatch & On-site Rates

Send an email to accounts@brocent.com. For managed service clients, you can also raise tickets directly via the client portal or contact your dedicated account manager.

Yes. Priority 1 incidents require immediate response. Contact your Service Delivery Manager (SDM) or account manager directly to initialise P1 service. Our P1 first-response SLA is 15 minutes.

You can escalate at any time to accounts@brocent.com or contact your account manager directly. We commit to service quality and will act on every escalation.

Yes. Our Service Command Center operates 24 hours, 7 days a week. If you are a new client who needs out-of-hours emergency support, contact accounts@brocent.com to activate your service account.

Standard Business Hours: Monday–Friday, 9am–6pm local time. 24×7 support is available for clients on the appropriate service plan (Managed IT Services or 24×7 Add-on). Token Service clients can select Normal or Emergency (24×7) SLA per request.

They're two genuinely different products for two buying situations. The add-on rates (Network & Wireless per 10 devices, Virtual Server per server) are per-market monthly rates that require an active Managed IT Support plan — they extend a plan you already have. The standalone plans (Starter/Pro/Enterprise) are monitor-count-based 24×7 NOC monitoring that need no Managed IT plan at all. If you have a plan, the add-ons are usually the right path; if you only want your infrastructure watched, go standalone. See Network, Server & Wireless Maintenance pricing for both side by side.

Copy link Network, Server & Wireless Maintenance

Yes. The standalone monitoring plans (from US$9/month) are deliberately independent — no Managed IT subscription required. You get 24×7 monitoring from 10+ global checkpoints, bundled support tickets, and remote/hotline service. Many clients start standalone and add a Managed IT plan later; nothing is lost in the transition.

Copy link Network, Server & Wireless Maintenance

Brocent's Network Operations Centre monitors network devices, servers, cloud workloads and applications around the clock from 10+ global checkpoints, with 1-minute health checks. Any unnatural condition triggers an immediate ticket and technician investigation. Onboarding takes about 4 days from intake survey to full coverage, with Brocent handling all monitoring-agent deployment.

Copy link Network, Server & Wireless Maintenance

Three transparent components: A — a one-time onboarding charge at activation; B — monitoring tool licences, charged annually by plan and monitor count; C — the recurring monthly plan price, which includes the 24×7 monitoring and the bundled support tickets. All three are published per tier on the pricing page — no hidden platform fees.

Copy link Network, Server & Wireless Maintenance

Through the quote builder on Managed IT Support — the add-ons appear alongside your plan tier with live per-market rates (Hong Kong, Singapore, Mainland China), the same figures shown on the maintenance pricing page. Existing clients can also just ask their account manager to add them mid-contract.

Copy link Network, Server & Wireless Maintenance

UniFi access points are configured and monitored centrally by the UniFi Network controller — it holds your SSIDs, VLANs, policies, topology and statistics. The software is free, but it has to run somewhere continuously: either a server you build and maintain (Java + MongoDB, ports opened, upgrades and backups yours), or a hardware Cloud Key on site, or a hosted controller like ours. Brocent already runs one on the BCS platform, so you register the access points you bought and skip the build entirely.

Copy link Network, Server & Wireless Maintenance

No. UniFi access points you already own can be adopted directly. If you do need new units we can supply them at published pricing and handle deployment, but that is a separate hardware purchase — controller hosting is priced per access point regardless of where the unit came from.

Copy link Network, Server & Wireless Maintenance

Yes — that is Model B. Rather than a hardware purchase, the access points come as part of the subscription: no capital investment to build enterprise-class wireless, the network ready within an hour, and hardware maintenance and replacement included, with a spare delivered and swapped within the agreed SLA at no extra cost for the repair. Everything behind the hardware — controller, 24×7 NOC monitoring, change process, monthly availability report — is identical to Model A. It is custom-quoted, since it scopes by sites and access-point count.

Copy link Network, Server & Wireless Maintenance

Yes, by logical isolation. The platform runtime is shared — which is part of why the per-access-point price is what it is — but the tenant is a hard boundary: your sites, devices, data, credentials and logs are scoped to your tenant, your accounts resolve only that scope, and Brocent engineer access is granted per client and logged. If your compliance requires a dedicated instance or a specific data jurisdiction, raise it before the quote so a consultant can scope it.

Copy link Network, Server & Wireless Maintenance

Yes. UniFi access points keep forwarding traffic using the configuration already pushed to them when the controller is unreachable. What is affected is management and statistics, not staff connectivity. The controller service itself runs highly available with a 99% availability commitment, and configuration is backed up daily with three-year retention.

Copy link Network, Server & Wireless Maintenance

Upgrades run in batches inside an agreed maintenance window, with a configuration backup taken beforehand, and never across a whole estate at once during working hours. Each upgrade goes through the same change process as any other change: assessed, confirmed with you, executed, verified and recorded — and the outcome appears in that period's report.

Copy link Network, Server & Wireless Maintenance

No — and neither can anyone else. Ubiquiti allows Protect, Access and Talk to run only on its own UniFi OS console hardware; they are not available as self-hosted or third-party-hosted software, and Ubiquiti's own UniFi OS Server package covers Network, InnerSpace and Identity rather than these. Access additionally needs an Access Hub on site for each door. If you need either, a UniFi OS console goes in your office and Brocent can specify, supply, deploy and maintain it — that is a hardware purchase, not a change to controller-hosting pricing.

Copy link Network, Server & Wireless Maintenance

Yes. The access points are your assets throughout. On termination the configuration can be exported and the devices adopted back into a controller you run yourself, or into a hardware Cloud Key. We host the control plane; we do not hold ownership of your network.

Copy link Network, Server & Wireless Maintenance

The published figure is the genuine starting point for the smallest common scope. What moves it: scope size (sites, headcount, racks, floors), the delivery market, timeline pressure and out-of-hours windows, and technical complexity. Whatever the final number is, it's fixed in a signed SOW before work starts — no time-and-materials drift. See Professional Services pricing for every published starting price.

Copy link Professional Services

Often, yes — prepaid token packs cover on-site, remote, cloud and project work, so smaller project tasks can simply draw down a token balance you already hold. Larger, defined-outcome projects (an office build-out, a relocation) are usually better as a fixed SOW quote. A consultant will price both paths side by side; compare Token Service pricing with the published project rates.

Copy link Professional Services

Yes. Project work is delivered across Brocent's direct-entity markets, with wider reach through the field dispatch network for on-site tasks. Travel and logistics for overseas dispatch are quoted separately in the SOW — the published starting prices assume in-market delivery.

Copy link Professional Services

The signed statement of work fixes: the scope and deliverables, a fixed price built from the published starting rates, the timeline and milestones, acceptance criteria you sign off against, and what counts as out-of-scope (with how changes are priced). It is the same document our consultants quote from — the website price and the sales price are one and the same.

Copy link Professional Services

Either. Licenses and hardware on the third-party pricing page are priced and sold standalone — no Managed IT plan required. Deployment, configuration and ongoing management (monitoring a firewall, patching a backup job, running an M365 tenant) are quoted and delivered separately if you want Brocent to run it for you.

Copy link Third-Party Software & Hardware

For most software licenses, no — published rates track the vendor's own list price; Brocent's value is bundled deployment, configuration and support, not a markup on the license itself. Ubiquiti and Synology hardware is priced at public list; Fortinet publishes no public list price, so its figures are indicative reseller/street pricing instead. Either way, installation and ongoing management are quoted separately.

Copy link Third-Party Software & Hardware

Yes. Standard vendor support, updates and warranty terms apply exactly as if you'd bought direct — buying through Brocent adds deployment and Brocent-side support on top, it doesn't replace or restrict what the vendor already provides.

Copy link Third-Party Software & Hardware

Yes for several: Microsoft Solutions Partner (Modern Work and Azure), Veeam Gold Partner, and a Fortinet partner for NGFW, SD-WAN, FortiEDR and FortiSIEM deployments — see full certifications on our Partners page. For the others we resell (Bitdefender, CrowdStrike, ESET, Webroot, Okta, 1Password, NordPass, ITGlue, Acronis, MSP360, Ubiquiti, Synology, NordLayer, NordStellar, DigiCert, Sectigo, SSL.com, Splashtop, TeamViewer, AnyDesk, ToDesk, Fleet, MeshCentral, RustDesk, Sunlogin, Hexnode, Microsoft Intune, Jamf, Adobe Acrobat, Foxit, Microsoft 365 Copilot, Zoom, Tencent Meeting, KnowBe4, Action1, JumpServer), we don't currently hold a named partner tier — we deploy and support them as an experienced reseller, not as a certified partner.

Copy link Third-Party Software & Hardware

All indicative prices default to USD. Use the currency switcher in the site header to view estimates in CNY, EUR, HKD, SGD, JPY or TWD at approximate exchange rates — actual invoicing is available in HKD, SGD, CNY, JPY, or EUR depending on your legal entity and billing location.

Copy link Third-Party Software & Hardware

Platform list prices on the Cloudways platform start at US$11/month for a 1 GB DigitalOcean server, rising with server size and cloud provider — Vultr, Linode, AWS and Google Compute Engine are also available. Autoscaling WordPress hosting (Cloudways Autonomous) starts at US$99/month. Brocent's management — provisioning, migration, patching, monitoring, backup and support — is quoted separately on top of the platform price. See Cloud Hosting & Application Services pricing →

Copy link Third-Party Software & Hardware

Brocent runs it for you as a managed service: we provision the servers on the Cloudways platform (a DigitalOcean company), migrate your sites or applications, and handle patching, monitoring, backup and day-to-day support — under one Brocent contract and invoice, rather than you administering a hosting account yourself. The platform's public list prices are published on the pricing page; Brocent's management is quoted separately, and your final quote is confirmed by Brocent at order time.

Copy link Third-Party Software & Hardware

WordPress and WooCommerce, Magento 2, Laravel, Joomla, Drupal, and custom PHP applications (PHP 7.4–8.4). The autoscaling Autonomous plans are WordPress/WooCommerce only — every other stack runs on the standard Flexible plans. See supported applications and pricing →

Copy link Third-Party Software & Hardware

We review Entra ID identity & MFA posture, conditional access policies, privileged role assignments, app permissions, and Intune device compliance — mapped against the CIS Microsoft 365 Benchmark, not just your Secure Score. See M365 Security Audit pricing →

Quarterly is the effective baseline for most SMEs; higher-risk teams (finance, HR) benefit from monthly campaigns. Our Security Awareness Starter runs either cadence, managed for you. See Security Awareness Starter pricing →

A scan finds and lists known vulnerabilities across your assets; a pentest has a human actively try to exploit them. Most SMEs should run managed scanning continuously and reserve pentests for compliance-driven or high-risk moments. See Vulnerability Scanning pricing →

Both. Patch Management Essentials covers OS-level updates and commonly-exploited third-party software (browsers, Java, Adobe, etc.), with a monthly compliance report — most self-run tools only handle OS patching well. See Patch Management pricing →

Every audit and scan ships with a prioritised, severity-ranked remediation roadmap and a debrief call, not just a raw findings dump. Hands-on remediation work itself is scoped separately if you want us to execute the fixes rather than your own IT team. See M365 Security Audit pricing →

Copy link Cybersecurity & IT Security

We treat each group by who owns it. Company laptops, Windows and Mac, are fully managed: enrolled through Windows Autopilot or Apple Business Manager, encrypted, protected by Defender and kept up to date. Personal phones are not enrolled. They get app protection only: Outlook, Teams and OneDrive require a PIN, work data cannot be copied into personal apps, and we can wipe the work data alone if a phone is lost or someone leaves. Personal computers get browser-only access with no downloads. The Intune audit report shows where each device stands today and the steps to reach this model.

Copy link Cybersecurity & IT Security

Register company Macs in Apple Business Manager so they enrol automatically, then manage them in Intune with FileVault encryption, Defender for Endpoint, enforced macOS updates and Platform SSO, so staff sign in to the Mac with their Microsoft 365 account. Macs bought outside Apple Business Manager can usually be added by the reseller. Apple's own approval can add one to two weeks to the first set-up.

Copy link Cybersecurity & IT Security

Yes. Our sample Microsoft 365 Security Audit and Intune Device Audit reports use a fictitious client. You can read the full sample online on its page, and download the PDF and Excel versions after a short form (company, name, work email and phone). Microsoft 365 Security Audit sample → Intune Device Audit sample →

Copy link Cybersecurity & IT Security

Read-only application permissions in Microsoft Graph, approved once by one of your Global Administrators: User.Read.All, UserAuthenticationMethod.Read.All, Reports.Read.All, Group.Read.All, GroupMember.Read.All, IdentityRiskEvent.Read.All, AuditLog.Read.All, RoleManagement.Read.Directory, Directory.Read.All, Application.Read.All, Policy.Read.All, DeviceManagementManagedDevices.Read.All, DeviceManagementConfiguration.Read.All, SecurityAlert.Read.All, SecurityIncident.Read.All and Organization.Read.All. If you use Defender for Endpoint, also Machine.Read.All, Vulnerability.Read.All and Score.Read.All. Read-only access for the Exchange, SharePoint and Teams settings is confirmed with you before consent. None of these permissions can change your tenant, and none can read the content of mail or documents. You can remove the application in Entra ID at any time.

Copy link Cybersecurity & IT Security

The Quick Security Check is a good first look: Secure Score, the CISA ScubaGear baseline, your top 20 fixes and a one-hour walkthrough. If you need evidence for a cyber-insurance or Cyber Essentials questionnaire, choose the CIS Benchmark Audit. It covers the full CIS Microsoft 365 Benchmark, including the controls Secure Score cannot see, and its report is built to be handed to an insurer.

Copy link Cybersecurity & IT Security

Both. Every re-scan produces a complete, dated report, and its first section lists what has changed since the previous scan: controls that now pass, controls that newly fail, and settings that changed. The Excel version includes the same change log, control by control.

Copy link Cybersecurity & IT Security

Every insurer sets its own rules, so we cannot promise what a particular insurer will accept. In practice they ask most about MFA, admin accounts, email security, endpoint protection, backups and log retention. The report has an insurer evidence section that answers those questions and points to a dated export for each answer, for example the MFA coverage per user, the Conditional Access policy list with its exclusions, and the SPF, DKIM and DMARC records. Many insurers also ask you to sign a short statement that the answers are accurate; we can prepare it for you to review.

Copy link Cybersecurity & IT Security

Remediation includes a short staff guide for every change that affects your users, such as registering a passkey or installing Outlook on a personal phone. Remote support for your users during the changes is included in specific packages; please speak to your account manager for details.

Copy link Cybersecurity & IT Security

Yes. The report maps each finding to the Cyber Essentials requirements and flags the items that would fail an assessment, such as a cloud account without MFA or personal phones that reach work data without a PIN. After the fixes, the same evidence helps you answer the questionnaire.

Copy link Cybersecurity & IT Security

Every security service has a published, fixed price by team size — no "send us your user count for a quote" required. The Security Starter Bundle runs US$399–1,290/mo across three bands (up to 25 / 26–75 / 76–150 users); the Quick Security Check one-time audit is free for teams up to 150 users. Above 150 users, pricing moves to a tailored quote. Recurring packages bill NET 30 from signing, the same terms as our existing managed-IT contracts. See all security pricing →

Copy link Cybersecurity & IT Security

An M365 audit report is typically delivered 5–7 business days after kickoff; a first vulnerability scan completes within 3–5 business days of access being granted. The Security Starter Bundle's full programme (audit, scan, patch agents, and phishing campaign) is live within 3–4 weeks of signing. See the full buyer journey →

One technical point of contact, ~15 minutes to grant Microsoft 365 read-only access, an endpoint list for patching, and an employee list for phishing training. That's materially less setup than self-running Qualys, KnowBe4 or Automox yourself. See what's included in the Bundle →

Either. M365 Audit, Vulnerability Scanning, Security Awareness Starter and Patch Management Essentials are all sold standalone with their own fixed pricing — the Bundle exists because buying all four together costs less than the sum of the parts, not because it's required. Compare individual services →

Copy link Cybersecurity & IT Security

Remote only — the audit, scanning, phishing training and patch agents are all delivered without a site visit, the same way Action1, Qualys and KnowBe4 operate. If you need physical/onsite work, that's our separate on-site IT dispatch service, quoted independently. See on-site IT dispatch →

Copy link Cybersecurity & IT Security

No. These are professional-services engagements — an audit is delivered, a scan runs, a training campaign is sent — not a software trial you can return. You can review a sample report before you buy to know exactly what you're getting.

Business-hours email/ticket support from a named engineer, under our standard SLA tiers (P2 ≤ 1 hour, P3 ≤ 4 business hours first response). This covers questions about your findings and report — it isn't 24×7 emergency incident response, which is part of our Managed IT plans. See our SLA →

No. The price covers the audit/scan/training/patching and a prioritised roadmap. Hands-on remediation — us doing the fixes rather than your own team — is scoped and quoted as a separate line item.

Standard format only — the same structure every time (risk score, executive summary, per-module findings, remediation roadmap, trend line), delivered online, as PDF and as Excel. We don't white-label or restructure reports per client.

A redacted sample of the standard report — the same one produced by our BCS IT Security Auditor engine — is linked from every security pricing page, so you can see exactly what you'll receive before signing. View a sample report →

A penetration test finds vulnerabilities across a defined set of systems, disclosed and scheduled with your IT team. A Red Team Engagement pursues one real objective, undisclosed to your defenders, and measures whether they'd detect and respond to a genuine intrusion — not just whether a hole exists. See Red Team Engagement →

Copy link Cybersecurity & IT Security

No — by design. Only a small "white cell," usually the CISO or one executive, knows the engagement is underway. That's what makes the detection-and-response test meaningful.

Copy link Cybersecurity & IT Security

The Rules of Engagement, agreed before the engagement starts, include a safe-word and stop conditions precisely for this. The white-cell contact can pause or end the engagement immediately if needed.

Copy link Cybersecurity & IT Security

Yes, generally. Red teaming assumes foundational vulnerability hygiene already exists — the value is in testing detection of an attacker who's already gotten past the easy stuff.

Copy link Cybersecurity & IT Security

Both: a written executive summary, attack-path timeline, and MITRE ATT&CK-mapped findings, plus a live purple-team debrief session with your team. See Red Team Engagement →

Copy link Cybersecurity & IT Security

Typically several weeks to a couple of months, depending on the objective and environment — most of that time goes into the lateral-movement phase, not initial access.

Copy link Cybersecurity & IT Security

Every engagement is scoped to a real objective and environment, so a published price list would be misleading rather than useful — the market for this service is quote-driven industry-wide. See Red Team Engagement →

Copy link Cybersecurity & IT Security

No — Phishing Test is a single benchmark campaign with no subscription. Security Awareness Training is the ongoing managed programme you'd move to if the results show you need one. See Phishing Test →

Copy link Cybersecurity & IT Security

You get the full results report and a debrief call. If the numbers point to a real gap, we'll recommend the right cadence — but there's no obligation to continue into a managed programme.

Copy link Cybersecurity & IT Security

A named engineer selects the pretext based on your actual business context — the goal is a realistic test, not a canned template that's easy to spot.

Copy link Cybersecurity & IT Security

Yes — finance, HR, and executive teams are common starting points given their typical exposure to targeted attacks.

Copy link Cybersecurity & IT Security

Penetration Testing includes social engineering as one vector within a broader technical assessment. Phishing Test is a focused, standalone benchmark on human risk alone — useful on its own or alongside a pentest.

Copy link Cybersecurity & IT Security

Pricing depends on team size, department scope, and channel (email vs. SMS/voice), so we quote it after a short scoping call rather than publish a number that wouldn't apply to most teams. See Phishing Test →

Copy link Cybersecurity & IT Security

It depends on the reason. A no-fault termination initiated by the employer under PRC Labor Contract Law Article 40 (e.g. the employee is unfit for the role even after training/reassignment, is unable to resume work after medical treatment, or the objective circumstances the contract relied on have materially changed) requires either 30 days' written notice or one month's salary paid in lieu of notice (代通知金) — the employer's choice. For-cause termination under Article 39 (serious violation of company rules, serious dereliction of duty, criminal conviction, etc.) requires no notice and no notice pay. Mutual-agreement termination follows whatever the parties agree. An employee who resigns must give 30 days' notice (3 days during probation) — this notice obligation runs the other direction.

Yes, in most cases. Under Article 46 of the Labor Contract Law, if a fixed-term contract expires and the employer decides not to renew it, or offers renewal on materially worse terms that the employee reasonably declines, the employer must pay statutory severance (economic compensation). The one exception: if the employer offers to renew on the same or better terms and the employee is the one who declines, no severance is owed. Model the termination cost →

Statutory severance (经济补偿金) is N months' average wage, where N is based on length of service and the average is the employee's average monthly salary over the 12 months before termination:

a. During probation — if terminated for cause (e.g. genuinely failed to meet the job's hiring criteria), no severance is owed. If it's a no-fault termination, ordinary length-of-service rules below still apply based on actual time worked.
b. Less than 6 months' service — 0.5 month's average salary.
c. 6 months to 1 year — rounds up to 1 month's average salary.
d. Over 1 year — 1 month per full year worked, plus 1 additional month if the remainder is 6 months or more, or 0.5 month if the remainder is under 6 months.

For high earners, monthly salary is capped at 3x the local average wage, and N is capped at 12 years.

It scales with the employment contract's term (Labor Contract Law Article 19): under 3 months — no probation permitted; 3 months to under 1 year — up to 1 month probation; 1 year to under 3 years — up to 2 months probation; 3 years or open-ended (unfixed term) — up to 6 months probation. Only one probation period is permitted per employer per employee, and it must be stated in the written contract to be enforceable.

Only if the relationship is a genuine freelance/independent-contractor arrangement with no employment relationship in substance — i.e. the individual controls their own hours, tools, and how the work gets done, and isn't managed day-to-day like staff. If in practice the company directs their daily schedule, integrates them into its org structure, and treats them like an employee, Chinese authorities and courts can deem it a de facto labor relationship (事实劳动关系) regardless of the contract's label — triggering retroactive social insurance and housing fund liability, fines, and employee-protection obligations like severance. This is a common misclassification trap, and enforcement has tightened: since September 2025, PRC judicial interpretation has made void any agreement where an employee agrees to forgo social insurance in exchange for cash.

The actual employer (实际用工单位) is the entity that uses the worker's labor and controls their day-to-day schedule and job assignments — regardless of which entity signs the paperwork, runs payroll, or issues invoices. That entity carries the employer's legal liability for social insurance, severance, and other labor obligations. This matters most in secondment, outsourcing, and engineer-placement arrangements, where the paper structure and the operational reality can diverge.

Length of service is 67 months: 5 full years plus a 7-month remainder. Since the remainder is 6 months or more, it rounds up to a full year, giving N = 6. Severance = N × average monthly salary over the last 12 months. Assuming an average monthly salary of CNY 25,000 (and below the local high-earner cap), severance = 6 × CNY 25,000 = CNY 150,000. If the termination is also a no-fault dismissal under Article 40, add either 30 days' notice or 1 month's salary in lieu (CNY 25,000) on top. Run your own numbers in the calculator →

Yes to both. The service agreement between the international customer and the China supplier needs to be structured so the China supplier is genuinely the engineer's actual employer — properly licensed, running payroll, social insurance, and housing fund contributions, and exercising real day-to-day management of the engineer. If instead the end customer directs the engineer's daily schedule, tasks, and discipline the way it would its own staff, Chinese authorities can find a de facto employment relationship between the end customer and the engineer, exposing the end customer to labor liabilities (back social insurance, severance, wage claims) despite having no direct contract with the individual. Using an unlicensed labor-dispatch arrangement compounds this risk: Article 92 of the Labor Contract Law imposes joint liability on the receiving company. See how Brocent structures compliant full-time engineer placement →

No. These answers summarize general PRC labor-law principles as background for planning purposes and reflect our understanding as of 2026 — they are not legal advice and don't account for local implementation rules, which vary by city and province. Always confirm specifics with qualified local counsel or your HR/legal advisor before acting.