Cybersecurity
An auditor asks for evidence, not policy. A tester asks what actually happens when someone gets in. We do both, and we write the findings so an engineer can reproduce them and a board can understand them.
Outcomes we hold ourselves to.
- Evidence an auditor accepts, not a folder of documents nobody has read
- Findings with reproduction steps — and a retest that confirms they are closed
- Every privileged account owned by a named person who knows they own it
What we usually find.
Not a sales pitch — these are the things that turn up again and again when we open the estate. If two or three sound familiar, you are in normal territory.
Around 400 active accounts for 250 members of staff, and nobody sure which of the extra 150 still matter.
Domain admin credentials sitting in a Group Policy file, unchanged for years.
Backups run every night. Nobody has attempted a restore.
Certificate services or delegation is misconfigured in a way that gives a standard user a path to domain admin in under an hour.
None of this is unusual, and none of it means anyone did a bad job. Estates accumulate. The work is finding out what is actually there before deciding what to change.
How we deliver it.
ISO 27001 & SOC 2
Scoping, risk methodology, control implementation and audit support.
Cloud security posture
Benchmark assessment, guardrails, detection coverage and monitoring.
Penetration testing
External, internal, web, API, mobile and cloud — with retest included.
Red team & adversary simulation
Objective-based testing of detection and response, not just prevention.
Identity & access management
Entra ID, SSO, phishing-resistant MFA, PAM and least-privilege in cloud.
Data protection & privacy
GDPR, CCPA and local data-protection regimes mapped to controls and named owners, including cross-border transfer.
Tools & platforms
Senior engineers, start to finish.
The engineer who scopes this work delivers it. You will know the team by name, they will sit in your standups, and they will still be there at the handover.
How we workReady to move on this?
Book thirty minutes with a senior engineer and get a straight answer on scope and cost.