01
Security assessment and priority roadmap
Turn risks into actionable improvements.
Without a view of systems, data and responsibilities, it is difficult to select measures that reduce the most important business risks. We first document permission, scope and accountable owners, then assess the environment, prioritise action and validate agreed improvements. You receive: a report describing findings, impact and recommended action; An ownership, priority and remediation validation plan.
Learn more
When it helps
Without a view of systems, data and responsibilities, it is difficult to select measures that reduce the most important business risks.
What we do
- Review of agreed settings, assets, processes and ownership
- Assessment of findings and remediation dependencies
- Prioritised actions, validation of fixes and evidence review
How it works
We first document permission, scope and accountable owners, then assess the environment, prioritise action and validate agreed improvements.
What you receive
- A report describing findings, impact and recommended action
- An ownership, priority and remediation validation plan
Illustrative example
Illustrative: an assessment identifies excessive administrator access and untested recovery; the highest priority gaps are addressed first.
How we measure success
- Resolved priority findings and validated fixes
- Coverage of agreed systems and responsibilities
After launch
Delivery and support depend on the agreed scope and specialist needs. Monitoring, incident response, forensics and other advanced services require a separate delivery arrangement.
Identity, access and cloud protection
The right access for people and services.
Excessive permissions, old accounts and unclear cloud settings increase the risk of unauthorised use of important information. We first document permission, scope and accountable owners, then assess the environment, prioritise action and validate agreed improvements. You receive: an access matrix and documented protection settings; Account management and access review procedures.
Learn more
When it helps
Excessive permissions, old accounts and unclear cloud settings increase the risk of unauthorised use of important information.
What we do
- IAM, MFA, administrator roles and least privilege
- Application access, service accounts and cloud resource review
- Joiner, role change, leaver and periodic access review procedures
How it works
We first document permission, scope and accountable owners, then assess the environment, prioritise action and validate agreed improvements.
What you receive
- An access matrix and documented protection settings
- Account management and access review procedures
Illustrative example
Illustrative: administrative roles are separated from everyday accounts, MFA is enabled and permissions receive periodic owner review.
How we measure success
- Unneeded and excessive access removed
- Agreed accounts covered by MFA and regular review
After launch
Delivery and support depend on the agreed scope and specialist needs. Monitoring, incident response, forensics and other advanced services require a separate delivery arrangement.
Application, API and AI solution security
Protection is part of design and development.
An application may disclose information or perform an inappropriate action when access, dependencies and input handling are not adequately checked. We first document permission, scope and accountable owners, then assess the environment, prioritise action and validate agreed improvements. You receive: prioritised corrections and development process recommendations; Tests of agreed security rules and documentation.
Learn more
When it helps
An application may disclose information or perform an inappropriate action when access, dependencies and input handling are not adequately checked.
What we do
- Architecture, code, dependency and sensitive setting review
- API authorisation, secrets, logging and secure development practices
- AI source permissions, instruction handling and human action approval
How it works
We first document permission, scope and accountable owners, then assess the environment, prioritise action and validate agreed improvements.
What you receive
- Prioritised corrections and development process recommendations
- Tests of agreed security rules and documentation
Illustrative example
Illustrative: an AI assistant retrieves only permitted documents, while CRM actions require clearly defined human approval.
How we measure success
- Validated access and approval boundaries
- Priority code and dependency issues resolved
After launch
Delivery and support depend on the agreed scope and specialist needs. Monitoring, incident response, forensics and other advanced services require a separate delivery arrangement.
Scoped specialist security validation
Clear permission, boundaries and a useful report.
Independent validation of exposed solutions needs a clearly defined scope, accountable specialists and a plan to address findings. We first document permission, scope and accountable owners, then assess the environment, prioritise action and validate agreed improvements. You receive: a report with impact, priorities and remediation guidance; Revalidation results for agreed fixes.
Learn more
When it helps
Independent validation of exposed solutions needs a clearly defined scope, accountable specialists and a plan to address findings.
What we do
- Written owner authorisation, scope and safe engagement rules
- Agreed timing, contacts, limitations and stop procedures
- Specialist assessment, reporting and remediation revalidation
How it works
We first document permission, scope and accountable owners, then assess the environment, prioritise action and validate agreed improvements.
What you receive
- A report with impact, priorities and remediation guidance
- Revalidation results for agreed fixes
Illustrative example
Illustrative: before a portal launch, independent validation is agreed for permitted components; the development team then corrects and verifies findings.
How we measure success
- Coverage of the written agreed scope
- Priority remediation and confirmation of corrections
After launch
Delivery and support depend on the agreed scope and specialist needs. Monitoring, incident response, forensics and other advanced services require a separate delivery arrangement.
Email, devices and security awareness
Everyday protection that people understand.
Outdated devices, misleading messages and unclear employee guidance create risks even with a well designed infrastructure. We first document permission, scope and accountable owners, then assess the environment, prioritise action and validate agreed improvements. You receive: agreed technical controls and employee guidance; A focused training programme and reporting channel.
Learn more
When it helps
Outdated devices, misleading messages and unclear employee guidance create risks even with a well designed infrastructure.
What we do
- Email, domain and device protection with agreed settings
- Updates, encryption, security policies and device management
- Practical training and a process for reporting suspicious events
How it works
We first document permission, scope and accountable owners, then assess the environment, prioritise action and validate agreed improvements.
What you receive
- Agreed technical controls and employee guidance
- A focused training programme and reporting channel
Illustrative example
Illustrative: an employee recognises a suspicious payment instruction, verifies the request and reports it to the responsible person.
How we measure success
- Devices covered by agreed protection measures
- Practical exercise success and timely reporting
After launch
Delivery and support depend on the agreed scope and specialist needs. Monitoring, incident response, forensics and other advanced services require a separate delivery arrangement.
Incident readiness and recovery
Everyone knows their role when trouble occurs.
Without agreed responsibilities, contacts and procedures, an incident delays decisions and the restoration of business services. We first document permission, scope and accountable owners, then assess the environment, prioritise action and validate agreed improvements. You receive: a response and recovery plan with named responsibilities; Exercise findings, improvements and validated recovery procedures.
Learn more
When it helps
Without agreed responsibilities, contacts and procedures, an incident delays decisions and the restoration of business services.
What we do
- Response plan, ownership, contacts and escalation stages
- Tabletop exercises, communication and decision documentation
- Recovery validation and scoped specialist escalation arrangements
How it works
We first document permission, scope and accountable owners, then assess the environment, prioritise action and validate agreed improvements.
What you receive
- A response and recovery plan with named responsibilities
- Exercise findings, improvements and validated recovery procedures
Illustrative example
Illustrative: a team rehearses reporting, decisions, communication and recovery for a selected business service.
How we measure success
- Reporting, decision and recovery time during the agreed exercise
- Resolved gaps in ownership and procedures
After launch
Delivery and support depend on the agreed scope and specialist needs. Monitoring, incident response, forensics and other advanced services require a separate delivery arrangement.
Scope and delivery options
Specialist security validation, monitoring, incident response and forensics are defined in a separate scope with suitable providers. Third-party systems are assessed only with written owner authorisation and agreed engagement rules.
Technologies and approaches
- MFA / IAM
- Additional sign-in verification and identity/access management.
- OWASP
- Guidance for web application security.
- Secure development
- Code, dependency and configuration review throughout development.
- EDR / SIEM
- Options for endpoint protection and security event correlation.
