Penetration testing
External, internal, web application, API, wireless and cloud testing, with findings mapped to MITRE ATT&CK.
Consulting & professional services
Expertise across the full security lifecycle.
From penetration testing and compliance readiness to fractional leadership and architecture, our consultants help you understand your risk, decide what to do about it, and get it done.
Assessments & testing
Know exactly where you stand.
Red team & social engineering
Objective-based adversary simulation, phishing, vishing and physical testing to test people and process, not just technology.
Security & risk assessments
A full review of your security program against NIST CSF 2.0 or CIS Controls, with a prioritized roadmap.
Ransomware readiness
Could you actually recover? Backup and restore testing, privileged access review and a written recovery plan.
Email & domain security
SPF, DKIM, DMARC, MTA-STS and DNSSEC assessed and deployed without disrupting legitimate mail.
Free domain check →IT & MSP review
An independent second opinion on your managed service provider, vendors or internal team.
Strategy & leadership
Senior leadership without the full-time cost.
Fractional CISO
Security program ownership, risk register, policies and board reporting, for a set number of days each month.
Fractional CIO & CTO
Technology strategy, budgets, vendor and contract management, and a seat at the leadership table.
Security program & roadmap
Program design, maturity targets and multi-year roadmaps aligned to business goals and budget.
AI & Copilot readiness
Data access clean-up, AI use policy and governance before rolling out Microsoft 365 Copilot or other AI assistants.
M&A technology due diligence
Security and IT risk review of acquisition targets, plus integration planning after the deal closes.
Vendor & contract management
Technology spend reviews, contract negotiation support and renewal planning.
Governance, risk & compliance
Meet the requirements your customers, insurers and regulators set.
Framework readiness
Gap assessments and remediation roadmaps for NIST CSF 2.0, ISO/IEC 27001, SOC 2, HIPAA, PCI DSS and CMMC.
Cyber insurance & questionnaires
Accurate answers to insurer applications and customer security questionnaires, and the gaps closed first.
Policies & procedures
A complete, right-sized policy library that your team can follow and your auditors will accept.
Third-party risk management
Vendor inventory, tiering and assessment so you know which suppliers can put you at risk.
Incident response planning
Incident response plans, playbooks and tabletop exercises with your leadership and technical teams.
Security awareness
Practical training and phishing simulations with reporting your insurer and auditors will accept.
Engineering & architecture
Design it right, build it right.
Microsoft 365 & Google Workspace hardening
Conditional access, admin roles, email protection, logging and backup, configured to a documented baseline.
Identity & access management
Single sign-on, phishing-resistant MFA, privileged access and identity governance.
Cloud security architecture
Secure landing zones and posture reviews for AWS, Azure and Google Cloud.
Network & zero trust
Segmentation, firewall reviews and VPN replacement with zero-trust access.
Projects & migrations
Cloud and email migrations, office moves and build-outs, and infrastructure refreshes.
Staff augmentation
Experienced engineers and analysts for a project, a backfill or an open role.
Ways to engage
Every engagement is scoped and quoted in writing before work begins.
Assessment
Find out where you stand
A defined review with a written report: security posture, penetration test, IT or MSP review, or compliance gap analysis.
- Clear scope and timeline
- Findings ranked by risk
- Executive summary and technical detail
Project
Get a specific job done
Implementations, hardening, migrations and remediation, delivered against a written statement of work.
- Defined deliverables
- Change-managed rollout
- Documentation and handover
Advisory retainer
Ongoing leadership
Fractional CISO, CIO or CTO support for a set number of days each month, without a long-term contract.
- Roadmap and budget
- Vendor and risk management
- Quarterly leadership reviews
Managed services
Day-to-day operations
Managed IT, help desk and 24/7 security operations, fully managed or co-managed with your team.
- Defined service levels
- Monthly reporting
- One point of accountability
Next step
Not sure where to start?
Tell us what prompted the question: an incident, an audit, an insurer, a customer or a gut feeling. We'll recommend a first step.