Capability · Cybersecurity and digital trust
Security you can prove to customers and auditors
We provide security advice, compliance preparation, application and API security, enterprise security and AI security. Our engineers also build production systems, so our advice is practical.
What we do
Six areas, one standard
Each area is a service in its own right, and any one of them can be the whole engagement. We work on systems we have built and on systems built by others. All six are practical: you are left with controls that work, not documents describing controls that should exist.
Application security
APIs, web, mobile and containers, secured during development
Read moreAI security
Safeguards, data separation and evidence for AI features
Read moreNetwork and cloud security
Secure foundations, network separation and configuration control
Read moreData security
Classification, customer separation, encryption keys and recovery
Read moreGovernance and compliance
ISO 27001, SOC 2 and evidence that collects itself
Read moreIdentity and privileged access
IAM and PAM: joiners, leavers, least privilege and temporary admin access
Read more
The situation
Why security questions are being asked now
Customers ask about your security before they sign a contract. Insurers ask before they give you a quote. Auditors ask for evidence rather than reassurance. In most growing organisations, nobody has checked whether the security they assume is in place actually works.
The pressure usually comes from one of these
- A customer security questionnaire you cannot fully answer
- An audit or certification with a fixed deadline
- A product that was built quickly and never had a security review
- APIs growing faster than anyone can keep track of
- AI adopted without rules on access or governance
- An incident that showed how little you could see
Our position
Security is not a document. It is a set of controls that work correctly under pressure, together with the evidence that they do.
How we work
Find it, prioritise it, fix it, prove it
We deliver findings as a prioritised list of work, each item with an owner and a clear fix, rather than a report with thousands of unranked issues.
Discover
We find out what actually exists: your systems, data, access routes, third parties and exposure.
Assess
We test your controls against a recognised standard, based on evidence rather than opinion.
Prioritise
We rank the issues by real business risk, not by the severity a scanning tool assigns.
Fix
We fix the issues alongside your teams, and build the fixes into how your systems are developed.
Evidence
We prepare the evidence for the people who will ask for it: your leadership, customers and auditors.
What you receive
- An assessment of your current security, with a maturity score
- Findings backed by technical proof, not just severity ratings
- A roadmap of fixes, ranked by risk
- Evidence packs mapped to the standards that apply to you
Understand your security before someone else tests it
We scope the assessment around the questions you are being asked, and give you evidence you can show a customer or an auditor.