Fixed-scope assessments
A defined scope, timeline and report. Best for testing, reviews and readiness work.
Application security
Security belongs in the development process, not at the end of it.
We review code before release and help engineering teams build security into how they work: threat modelling at design, automated checks in the pipeline and review at every release.
What we deliver
- Secure code review
- Secure development lifecycle
- DevSecOps
How an engagement runs
- Scope
- We agree what is in and out of scope, the rules of engagement and who to call if something critical is found.
- Prepare
- Access, accounts and test windows are arranged so the work does not disrupt your operations.
- Deliver
- The assessment, design or readiness work itself, with progress updates at agreed points.
- Report
- Every engagement ends with an executive summary and a prioritised remediation plan.
- Verify
- Once fixes are made, we re-test or review them and confirm what has been closed.
How we engage
Managed security retainers
Ongoing monitoring, vulnerability management and advice, delivered with Kytheos.
Retained incident response
Agreed response arrangements in place before you need them.
Concessional SME packages
Assessments and awareness training sized for small and mid-sized businesses.
Begin with an assessment.
Our work follows recognised frameworks, including OWASP, NIST CSF and MITRE ATT&CK. Every engagement ends with an executive summary and a prioritised remediation plan.