Services

Penetration testing

We use scanners for coverage, then spend most of the time on manual work: access control between users and tenants, business logic, authentication flows and the way services trust each other. Those are areas automated tools tend to miss.

Tenders in India, the Gulf and much of Asia often call this VAPT (vulnerability assessment and penetration testing).

• Web applications and REST or GraphQL APIs, tested against OWASP WSTG and ASVS
• iOS and Android apps against OWASP MASVS, including the backend they call
• AWS, Azure and Google Cloud configuration and IAM reviews, checked against CIS Benchmarks
• External and internal network tests, including Active Directory
• Source code review for high-risk components

You receive a report with a leadership summary, and a walkthrough call. Findings come in priority order, each with a CVSS v4.0 base score, our rating for your context, evidence, reproduction steps and a fix. Issues that chain together are shown as one attack. Retesting can be added to the scope.

Audit readiness

For a first certification or a regulator's deadline. We start from what you already do, write down what's missing, and help your team run the controls for long enough to build up the evidence an audit looks for.

• Gap or readiness assessment against the standard or regulation, with a prioritised plan
• Policies and procedures written around how your company actually operates
• Risk assessment and Statement of Applicability (ISO 27001)
• Evidence collection and readiness checks before the auditor arrives
• Preparing for management review and internal audit
• Support during the external audit, including auditor queries

We don't issue ISO certificates, SOC 2 reports or PCI DSS reports on compliance. An accredited certification body, a licensed CPA firm or a QSA does, and decides the outcome.

Virtual CISO (vCISO) and GRC programme

Many companies need a security lead before they can justify hiring one full-time. A virtual CISO gives you that person for a set number of days each month.

• Security strategy and a roadmap
• Risk register and policy ownership
• Regular reporting to leadership and the board
• Customer security questionnaires and due diligence calls
• Incident response planning and tabletop exercises
• Preparing for surveillance and recertification audits

Usually a monthly retainer, though it can also be a fixed project, such as preparing for a first audit. The roadmap and risk register are mapped to NIST CSF 2.0 or ISO 27001, whichever you report against.

Managed vulnerability scanning

Scheduled scanning and a person reviewing the output. We confirm each issue, remove duplicates and false positives, and send you the ones that need fixing with a suggested owner and deadline. Priority depends on whether an issue is known to be exploited and how exposed the system is, not only on its CVSS score.

• Scheduled external and internal vulnerability scanning, with a retest to confirm each fix
• Cloud security posture monitoring
• Regular reporting on open risk and how quickly it's being fixed
• Notes on newly disclosed vulnerabilities in software you run

Where possible we use the scanning tools you already pay for. This is not a round-the-clock security operations service.

Third-party risk

Checking the security of suppliers who hold your data, and answering the security questionnaires your own customers send.

• Supplier risk framework, with suppliers tiered by the data they hold and the access they have
• Supplier assessments and follow-up on findings
• Completing inbound questionnaires (SIG, CAIQ and custom formats)
• A security pack and trust page content for your sales team

When we assess a supplier, we look at the evidence behind the answers, such as the scope and exceptions in a SOC 2 report or the scope of an ISO 27001 certificate.

OT and ICS security

We plan each assessment with your plant engineers. We start with passive methods and test a live process actively only inside an agreed change window.

• Architecture review against the Purdue model, including every route between the IT and control networks
• Passive asset discovery and traffic analysis
• Zone and conduit risk assessment following IEC 62443-3-2, with guidance from NIST SP 800-82
• Remote access and vendor connection review

We work from your network diagrams and interviews with operations staff. You receive an asset inventory, an annotated network diagram, findings ranked by their effect on safety and production, and a prioritised plan.

Risk assessments and training

Standalone risk assessments for a new product, acquisition or market. Training is short and specific to the audience.

• Information security and privacy risk assessments
• Data protection impact assessments (DPIA)
• Secure development training for engineering teams
• Awareness sessions and phishing simulations for staff

Results show how many people reported the message, not only how many clicked, and attendance records can be kept as audit evidence.