Strategy, technical depth
and practical execution.

Strategic Advisory

Security strategy, target operating models, board reporting and CISO support for organisations building or rebuilding their program.

• Security strategy and multi-year roadmap
• Target operating model and team design
• CISO-as-a-service and interim leadership
• Board-level risk reporting and KPI frameworks
• Due diligence for M&A and investment
• Security budget arbitration and business cases

Audit & Compliance

Posture assessment against ISO 27001, GDPR, NIS2 and sector regulation. Gaps identified, risks prioritised, governance strengthened.

• ISO 27001 readiness and certification support
• NIS2 and DORA gap analysis
• GDPR technical and organisational measures review
• Third-party and supply chain assessment
• Control maturity scoring against NIST CSF
• Remediation planning with owners and deadlines

Application Security

Threat modelling, secure design reviews, code and pipeline assessment. Security built into the SDLC rather than bolted onto it.

• Threat modelling and secure design review
• Source code review, manual and tool-assisted
• CI/CD pipeline and supply chain hardening
• Secrets management and dependency governance
• SAST / DAST / SCA tooling selection and tuning
• Secure SDLC definition and rollout

Penetration Testing

Targeted and full-scope testing that uncovers real attack paths and business-impacting weaknesses — reported for both boards and engineers.

• External and internal infrastructure testing
• Web, API and mobile application testing
• Cloud configuration and privilege escalation review
• Red team and assumed-breach scenarios
• Social engineering and phishing simulation
• Retest and remediation verification included

Salesforce Security

Configuration and permission model review, access control analysis, secure integration design and AgentForce governance.

• Permission and sharing model review
• Profile, role and org-wide default analysis
• Secure integration and API design
• Apex and Lightning component code review
• AgentForce and Einstein governance
• Continuous drift detection via AgentForce Shield

Monitoring & Threat Intelligence

Dark web monitoring for credential leaks and exposed assets, plus curated contextual intelligence that SOC teams can actually act on.

• Dark web and paste-site credential monitoring
• External attack surface discovery
• Brand impersonation and typosquat tracking
• Curated, contextual threat intelligence for SOC teams
• Detection engineering and use-case development
• SOC readiness assessment and tuning

Training & Awareness

Hands-on DevSec Champions programs for developers and engineers, built on secure coding and real attack scenarios — not slideware.

• DevSec Champions program design and delivery
• Language-specific secure coding workshops
• Executive and board cyber briefings
• Incident response tabletop exercises
• Phishing and awareness campaign design
• Champion maturity scoring and reporting

Security Engineering

Architecture, identity, cloud and detection engineering. We design the control, implement it with your teams, and verify it works.

• Security architecture and reference design
• Identity and access management engineering
• Cloud security posture and landing zones
• Detection and response engineering
• Zero trust and network segmentation design
• Hardening standards and infrastructure-as-code