About Envenox
We build the software. Then we try to break it.
Envenox is a software development firm. We ship production systems — custom software, web applications, ERP and the platforms underneath them — and we keep an offensive security practice on staff that attacks what we build before anyone else gets the chance.
Two practices, one firm
Cybersecurity
Testing, assurance, detection and response — by people who also ship production software.
Our testers are not career report-writers. They have shipped systems, which is why their findings arrive with a fix an engineer will accept rather than a recommendation an engineer has to translate.
CybersecuritySoftware Development
Products, platforms and business systems built to survive an audit and a handover.
Our engineers work next to a security practice that will attack what they build. That changes how authorisation, audit logging and secrets get designed — before the first commit rather than after the first report.
Software DevelopmentEnvenox is a software development firm. We design, build and hand over the systems a business runs on — custom software, web applications, ERP, CRM, and the cloud platforms underneath them. What makes the work defensible is that we keep an offensive security practice on staff: our penetration testers read the code our engineers are writing and file findings into the same sprint backlog, so a system arrives already attacked rather than waiting for its first external test. That practice also works on its own, for clients who never buy a line of code from us. We work with regulated organisations across finance, healthcare, logistics and public sector, and we publish our own security posture at /trust.
Capacity, with its provenance
Certifications held by the people, not the brochure
- 14OSCP
- 6CISSP
- 4CREST CRT
- 3OSWE
- 5AWS Solutions Architect
- 2ISO 27001 Lead Auditor
14 OSCP · 6 CISSP · 4 CREST CRT · 3 OSWE · 5 AWS Solutions Architect · 2 ISO 27001 Lead Auditor · 38 engineers and testers on staff
Who you would actually work with
Tomás Lindqvist
Chief Executive
Amara Nwosu
Chief Operating Officer
Imran Haque
Head of Offensive Security
- OSCP
- OSWE
- CREST CRT
- GIAC GXPN
Sofia Marek
Principal Application Security Engineer
- OSWE
- CISSP
- GIAC GWAPT
Marcus Reid
Head of Engineering
- AWS Solutions Architect Professional
Priya Raman
Principal Architect
- AWS Solutions Architect Professional
- CKA
All 9 — with bios and the certifications each security lead holds
What the company itself is certified against
| Certification | Issuer | Certificate | Expires |
|---|---|---|---|
| ISO/IEC 27001:2022Delivery of cybersecurity and software development services, London and Dhaka. | UKAS-accredited certification body | — | 2029-03-13 |
| ISO 9001:2015Software development delivery. | UKAS-accredited certification body | — | 2028-09-01 |
| SOC 2 Type IIEnvenox engagement platform and evidence workspace. Report available under NDA. | Independent CPA firm | — | 2027-06-29 |
| Cyber Essentials PlusWhole organisation. | IASME, on behalf of the NCSC | — | 2027-05-19 |
| CRESTPenetration testing services. | CREST International | — | 2027-10-31 |
| PCI DSS Qualified Security AssessorPCI DSS 4.0 assessment and advisory. | PCI Security Standards Council | — | 2027-01-14 |
Every certificate in fullIncluding the one we do not hold, and why
Our method
The Adversary Loop
Threat models shape the build. The build gets attacked. The attack rewrites the threat model.
- ModelBefore the first sprint, with the people who will own the components.
- BuildOrdinary good delivery, with security reading the decisions as they are made.
- AttackContinuously during the build, then independently before release.
- WatchDetections written by people who have been reading this system for months.
- RewriteWhat was found goes back into the model. This is the whole point.
Selected clients
- Northgate Freight
- Lumen Clinical
- Verity Payments
- Aldercross Group
- Mereway Housing
- Hallstead Retail
- Carrick Analytics
- Pelham Energy
- Severn Mutual
- Orbis Education
Third-party reviews, by pillar
- 4.9
Clutch
31 reviews · read on the software side
Clutch profile - 4.7
G2
44 reviews · read on the software side
G2 profile - 4.6
Gartner Peer Insights
18 reviews · read on the security side
Gartner Peer Insights profile
Where we are, and joining us
Where we are
- London, United Kingdom1 Fore Street Avenue, London EC2Y 9DT
- Dhaka, BangladeshLevel 7, Bay’s Galleria, Gulshan 1, Dhaka 1212
Joining us
Open roles are listed with salary bands, because a role advertised without one wastes everybody’s afternoon.
Every engineer and tester is background-checked before they are assigned to an engagement, and the policy is published here rather than described on request.
Book a 60-minute scoping call
A technical conversation with the person who would lead the work — not a qualification script, not a discovery deck. You come away with a written scope, the exclusions stated in the body rather than in an appendix, and a day count that we have not padded.