Services
Cybersecurity and Software Development
Envenox is a software development firm. We ship production systems — custom software, web applications, ERP and the platforms underneath them — and we keep an offensive security practice on staff that attacks what we build before anyone else gets the chance.
Projects, programmes, retainers and embedded teams — and which of them you do not need.
How the work divides
Two pillars, and the seam between them
Threat models shape the build. The build gets attacked. The attack rewrites the threat model.
Pillar one
Cybersecurity
Testing, assurance, detection and response — by people who also ship production software.
Our testers are not career report-writers. They have shipped systems, which is why their findings arrive with a fix an engineer will accept rather than a recommendation an engineer has to translate.
The seam
Secure SDLC
We build it and we break it. The findings land in our own sprint backlog.
One firm, two practices, one backlog. The seam between build and break, removed.
Pillar two
Software Development
Products, platforms and business systems built to survive an audit and a handover.
Our engineers work next to a security practice that will attack what they build. That changes how authorisation, audit logging and secrets get designed — before the first commit rather than after the first report.
We build it and we break it. The findings land in our own sprint backlog.
The standard arrangement is that a development firm builds your software for forty weeks and a security firm tests it in week forty-one. Everything that test finds is now expensive, because the architecture is set, the team is rolling off, and a finding that requires a design change arrives after the design is load-bearing. Both firms behaved correctly and the outcome is still bad. Our two practices run against each other continuously instead: our testers review the design before it is built, read the code as it is written, and raise findings into the same backlog our engineers work from. The number that matters is the nine days between a finding being confirmed and the fix being live, and it is only possible because there is no handover in the middle.
Pillar one
Cybersecurity
Testing, assurance, detection and response — by people who also ship production software.
Manual, evidence-led testing with criticals reported the hour they are confirmed.
- Technical report — every finding with CVSS v4.0 vector, affected component, reproduction path, raw request/response evidence, and a remediation we would accept in code review
- Executive summary — two pages, written for a board, with the risk narrative and the three decisions that matter
- Findings register as CSV and JSON, keyed for direct import into Jira, Linear or ServiceNow
Secure code review, CI gates and threat models that engineers will actually maintain.
- Threat model per bounded context, authored by your engineers, in your repository
- Code review findings as pull request comments plus tickets in your tracker
- Working CI configuration for SAST, DAST, SCA and secret scanning, with the tuning rationale documented
Identity-path analysis across AWS, Azure and GCP, not a CSPM findings dump.
- Identity graph with every privilege-escalation and lateral-movement path, as a diagram and as queryable data
- Configuration findings filtered to what is exploitable in your topology, with CIS benchmark mapping
- Detection coverage matrix against MITRE ATT&CK for Cloud
SOC 2, ISO 27001, PCI DSS, DORA and NIS2, evidenced from systems you already run.
- Readiness report with a costed, ordered gap list
- Risk methodology, risk register and Statement of Applicability
- Policy set written for your organisation, not a template pack
24/7 detection and response on your telemetry, with detections written for your architecture.
- Detection repository, version-controlled, mapped to MITRE ATT&CK, yours to keep
- Validated log source inventory with coverage gaps named
- Incident runbook with agreed containment authority and escalation paths
24/7 hotline answered by a responder. Retainer or emergency.
- Incident timeline with evidence references and chain of custody
- Root cause analysis naming the control that failed and the control that would have caught it
- Indicators of compromise, with detections to prevent recurrence
Objective-based adversary simulation, with a purple-team debrief that transfers the knowledge.
- Attack narrative with a full timeline and the evidence for each step
- Detection and response assessment: what fired, what did not, and how long each decision took
- Technique-by-technique ATT&CK mapping with your coverage marked
Fractional security leadership, with an explicit plan to make itself redundant.
- Posture assessment and costed risk baseline
- Board-ready security strategy and quarterly reporting pack
- Risk register with owners, treatments and closure dates
Pillar two
Software Development
Products, platforms and business systems built to survive an audit and a handover.
Production systems with authorisation, audit and secrets handled properly from the first commit.
- Working software in production, with the source in your repository under your licence
- Architecture decision records explaining why, not just what
- Threat model and a clean penetration test report at go-live
Server-rendered, budget-enforced front ends that work before JavaScript arrives.
- Production application with the source in your repository
- Styleguide route rendering every component in every theme and state
- Performance budgets wired into CI with the rationale documented
Reproducible infrastructure, short-lived pipeline identity, and a rehearsed rollback.
- Infrastructure as code, reproducible from an empty account, in your repository
- CI/CD pipeline with short-lived identity and automated rollback
- Service level objectives with error budgets and alerting that requires action
Finance, inventory and procurement modelled on your exceptions, with history reconciled.
- Process documentation as implemented, including exception handling
- Configured and tested system with role-based access and segregation of duties
- Migration reconciliation reports signed off by finance
Pipeline, activity and forecasting designed so sellers get something back from every field.
- Configured CRM with the agreed data model and stage definitions
- Automatic activity capture from email, calendar and telephony
- Forecast model with visible assumptions
Field-level access control, read-auditing, and joiner-mover-leaver flows that complete.
- Configured system with field-level access control and read-auditing
- Data protection impact assessment and a records-of-processing entry
- Joiner-mover-leaver orchestration with completion tracking
Audit-grade completion evidence with content people finish inside the window.
- Learning platform with authoring, versioning and SCORM/xAPI support
- Rule-based assignment engine with recurrence and escalation
- Audit-grade completion evidence, exportable
Deterministic end-to-end suites with a flake budget and a quarantine process.
- Written test strategy including what is deliberately not automated
- End-to-end suite covering the critical journeys, with isolated test data
- CI configuration with parallelisation, sharding and failure artefacts
Commercial shape
Engagement Models
How a security retainer and a delivery retainer actually differ, stated plainly.
Security retainers and software retainers are both called retainers and they behave nothing alike. A security retainer buys reserved capacity against an unpredictable need — you hope not to use the incident hours. A delivery retainer buys a standing team against a predictable need — if you do not use the capacity, you have wasted it. Blurring the two is how a client ends up paying for a dedicated squad to handle incidents that happen twice a year, or expecting an incident retainer to absorb a six-month build. This page exists so the distinction is clear before the commercial conversation, not during it.
Fixed-scope project
A bounded piece of work with a defined output: a penetration test, a cloud review, a discovery phase. Fixed price where the scope is genuinely knowable.
Programme
Multi-phase work with a defined destination — a certification, a platform uplift, a system replacement. Priced by phase, reviewed monthly.
Security retainer
Reserved capacity: testing days each quarter, incident hours, and advisory access. Priced on availability, because availability is what you are buying.
Embedded team
A standing squad on a quarterly commitment, working in your process, in your repository, in your stand-up.
Capacity
The firm behind the services
Selected clients
- Northgate Freight
- Lumen Clinical
- Verity Payments
- Aldercross Group
- Mereway Housing
- Hallstead Retail
- Carrick Analytics
- Pelham Energy
- Severn Mutual
- Orbis Education
Not sure what you need?
Book a 60-minute scoping call
Tell us what you are trying to achieve and what constrains it. If what you need is not what you asked for, we will say so on the first call rather than in month three — we have told clients to buy two penetration tests instead of the red team they came for, and to buy a package instead of the custom build.
A technical conversation with the person who would lead the work — not a qualification script, not a discovery deck. You come away with a written scope, the exclusions stated in the body rather than in an appendix, and a day count that we have not padded.
- Secure SDLCOne firm, two practices, one backlog. The seam between build and break, removed.
- CybersecurityTesting, assurance, detection and response — by people who also ship production software.
- Software DevelopmentProducts, platforms and business systems built to survive an audit and a handover.
- Engagement ModelsProjects, programmes, retainers and embedded teams — and which of them you do not need.
- Walk a sample reportSee what actually lands in your inbox before you buy one.
Before you ask
Questions buyers ask
- Is it a conflict of interest to test your own build?
- It would be if the same person did both, so they do not. The pre-release test is led by a tester who has not contributed code, the report comes to you unedited, and a third reviewer signs it. We will also support an independent third-party test and share the threat model with them — our commercial interest in a clean report is exactly why your structural scepticism is correct.
- Can we start with one test and expand?
- Most clients do, and it is the sensible order. A single test tells you whether you want to work with us before either side commits to a programme.
- Do you work fixed price?
- For bounded work with a knowable scope, yes — tests, reviews, discovery phases. For a build, time and materials against a prioritised backlog with a cap and a monthly review, because a fixed price for an undesigned build is priced for the worst case and then spent defending the scope boundary.
- What does an incident retainer actually reserve?
- Hours, a response time, pre-agreed rates, a pre-signed NDA, and a team that has already read your architecture. The last of those is the one that saves the most time in hour one, and it is the one you cannot buy during an incident.
- Can we buy security and software on one agreement?
- Yes, and it is the common case. One master services agreement, separate statements of work per engagement, one account team. The pre-release test is still signed by someone independent of the build.
- Can you apply this to our in-house team?
- Yes, and it is a common engagement. The security practice embeds with your delivery team, the gates and the backlog are yours, and the goal is that your engineers own the model within two quarters. We bring the testers; you keep the capability.
- Does this replace a penetration test?
- No — it contains one, and adds the continuous work around it. If you only want the point-in-time measurement, buy the test on its own; it is a legitimate purchase. This is for building a system that passes it.
Get started
Book a 60-minute scoping call
A technical conversation with the person who would lead the work — not a qualification script, not a discovery deck. You come away with a written scope, the exclusions stated in the body rather than in an appendix, and a day count that we have not padded.
A named engineer replies within one business day. Scoping call within three.
The Adversary Loop
Threat models shape the build. The build gets attacked. The attack rewrites the threat model.