Site map
Everything on this site, in one list
105 pages, grouped. Every entry is generated from the same data that renders the page, so this list cannot drift out of date and cannot contain a link to something that no longer exists.
Start here
5 pagesTalk to us
4 pagesThe incident hotline is a plain telephone link on every page of this site, including this one.
Services
35 pagesHubs
Cybersecurity
- Penetration TestingManual, evidence-led testing with criticals reported the hour they are confirmed.
- Application SecuritySecure code review, CI gates and threat models that engineers will actually maintain.
- Cloud SecurityIdentity-path analysis across AWS, Azure and GCP, not a CSPM findings dump.
- GRC & ComplianceSOC 2, ISO 27001, PCI DSS, DORA and NIS2, evidenced from systems you already run.
- Managed Detection & Response24/7 detection and response on your telemetry, with detections written for your architecture.
- Incident Response24/7 hotline answered by a responder. Retainer or emergency.
- Red TeamingObjective-based adversary simulation, with a purple-team debrief that transfers the knowledge.
- vCISOFractional security leadership, with an explicit plan to make itself redundant.
Software development
- Custom SoftwareProduction systems with authorisation, audit and secrets handled properly from the first commit.
- Web Application DevelopmentServer-rendered, budget-enforced front ends that work before JavaScript arrives.
- Platform & DevOpsReproducible infrastructure, short-lived pipeline identity, and a rehearsed rollback.
- ERPFinance, inventory and procurement modelled on your exceptions, with history reconciled.
- CRMPipeline, activity and forecasting designed so sellers get something back from every field.
- HRMField-level access control, read-auditing, and joiner-mover-leaver flows that complete.
- LMSAudit-grade completion evidence with content people finish inside the window.
- QA & Test AutomationDeterministic end-to-end suites with a flake budget and a quarantine process.
Where the two meet
Buying questions
- Red teaming vs penetration testingRed Teaming
- What is a purple team?Red Teaming
- Are we ready for a red team?Red Teaming
- How penetration testing is pricedPenetration Testing
- Should you test production or staging?Penetration Testing
- How to tell a penetration test from a scanner exportPenetration Testing
- SOC 2 Type I or Type II?GRC & Compliance
- Doing ISO 27001 and SOC 2 togetherGRC & Compliance
- How to scope ISO 27001 without doubling the costGRC & Compliance
- What an MDR service level should commit toManaged Detection & Response
- Build or buy a SOCManaged Detection & Response
- Do we need an incident response retainer?Incident Response
- Fixed price or time and materials?Custom Software
- Build or buy your ERPERP
Industries
7 pages- All industries
- Financial ServicesDORA is in force, your card scheme audit samples remediation evidence, and the PRA expects you to have tested a severe but plausible scenario rather than described one.
- HealthcarePatient data is special category data, clinical safety is a regulated discipline, and the DSPT asks whether your audit log can be tampered with.
- SaaS & TechnologyEnterprise procurement now treats SOC 2 Type I as a staging post, and your largest prospect wants a penetration test report before the pilot, not after it.
- Logistics & ManufacturingNIS2 brings a 24-hour early-warning obligation and personal management accountability, and your customs systems cannot go offline to accommodate either.
- Public SectorA Cyber Assessment Framework return is due, your certification scope was drawn around the whole organisation, and the evidence is being collected by hand.
- Retail & PaymentsCardholder data scope grows quietly, PCI DSS 4.0 now mandates client-side script integrity, and there is a peak-season window where nothing may change.
Proof
11 pagesIndividual case studies
- Enterprise payments provider, 900 employeesFinancial Services · Retainer
- Clinical workflow vendor, 180 employeesHealthcare · Programme
- Precision components manufacturer, 420 employeesManufacturing · Programme
- Freight and customs broker, 1,200 employeesLogistics · Retainer
- B2B SaaS platform, 140 employeesSaaS & Technology · Project
- Arm’s-length public body, 650 employeesPublic Sector · Programme
Resources
17 pagesHubs
- All resources12 items across seven types
- InsightsShorter pieces on things we keep having to explain.
- Research & LabsFindings from our own work, with the data and the method.
- Open-source toolsTools we use on engagements, released because they are more useful shared.
- MethodologiesHow we actually run an engagement, published so you can hold us to it.
Individual resources
- Identity-path analysis beats configuration scanning: 14 cloud estates reviewedResearch · 12 min read · in progress
- A third of configured log sources deliver nothing: what we find during MDR onboardingResearch · 9 min read · in progress
- How we score severity, and why we show the adjustmentMethodology · PDF, 9 pages · in progress
- Web application and API testing methodologyMethodology · PDF, 14 pages · in progress
- trustgraph — enumerate every privilege path in an AWS organisationOpen-source tool · GitHub · in progress
- logsource-check — prove your log sources are actually deliveringOpen-source tool · GitHub · in progress
- Why your authorisation bug keeps coming backInsight · 7 min read · in progress
- A backup job reporting success is not a backupInsight · 6 min read · in progress
- Four days of scoping undid two years of a stalled ISO 27001 attemptInsight · 8 min read · in progress
- Do not buy a red team yetInsight · 5 min read · in progress
- The secure SDLC field guide: moving findings earlier without slowing deliveryGuide · PDF, 38 pages · in progress
- DORA threat-led penetration testing: what the independence criteria actually meanWebinar · 50 min watch · in progress
Company
16 pagesPages
People
- Imran HaqueHead of Offensive Security
- Sofia MarekPrincipal Application Security Engineer
- Daniel OkaforHead of Detection & Response
- Claire BenoitPractice Director, Governance & Risk
- Marcus ReidHead of Engineering
- Priya RamanPrincipal Architect
- Tomás LindqvistChief Executive
- Amara NwosuChief Operating Officer
- Jo WhitfieldHead of People
Legal and system
7 pages- All legal and system pages
- Vulnerability disclosure policyHow to report a security issue in our own systems, what we will do with it, and what we will not do to you.
- Accessibility statementWhat this site conforms to, what we have tested, what we know is imperfect, and how to tell us when we are wrong.
- Privacy noticeDraft — not reviewed by counsel
- Cookie policyDraft — not reviewed by counsel
- Terms of useDraft — not reviewed by counsel
- Site mapThis page
Machine-readable
Not pages, but people look for them, and a security firm hiding its own security.txt would be a poor advertisement.