Services
We test what the industry takes on trust
Whether the patch shipped, whether the control is enforced, whether the finding is reachable: these are usually assumed. We have published measurements of all three. Each one is on the page for the work it came from, with how it was measured and what it does not support written underneath.
- AI Security
An AI feature is still an application, and prompt injection is an architecture problem rather than a guardrail one. The way in is usually ordinary.
- Red Teaming
Getting in is routine. What we measure is how far an attacker gets before anyone notices, and what your detection team does when it does.
- Telco Security
Operator networks differ too much for a benchmark to say anything about yours. Interconnect, RAN, SIM, IMS and core: our subject since 2010.
- Device Testing
Signed firmware stops the attacks people think of first. We look for the update chain that can be redirected, the key shared across every unit, and the cloud the device trusts.
- Cloud Security
Workloads, storage, networks, and the identity layer that ties them together. Three depths, from an automated pass over every account to a full review of the operation around it.
- Software Assurance
Scanners find the bugs common to every codebase. The expensive ones are specific to yours. We agree in writing what must never happen, then read the code and the design against it.
- Blockchain Security
Contracts, chain runtimes and bridges. Where the runtime upgrades under you, the upgrade path is itself an attack surface. A Polkadot runtime reviewed continuously since 2019.
- Incident Response
Technical containment is half of an incident. The other half is a dozen people needing to decide at once. We rehearse both beforehand and run both on the day, in five countries, at any hour.
- Vulnerability Prioritization
Ranked by what an attacker can reach in your environment. Severity is a weak guide to that. Each finding leaves with an owner’s name on it.
- Security Team Incubation
Hiring a security lead works once there is a team. Before that we size the roles, steer the hiring, and run the security work, then hand it over and leave.
- Security Maturity Review
The organisation and the controls, reviewed together. What stops a programme is rarely a missing product. It is an unowned decision, or a control bought and never finished.
Not sure which of these you need?
Describe the system and what worries you about it. We will tell you what we would test, roughly what it costs, and whether we are the right team for it.