Strategy, technical depth
and practical execution.

Strategic Advisory

Security strategy, operating models, board-level reporting and CISO support for organisations strengthening or transforming their security programme.

• Security strategy and prioritised transformation roadmap
• Target operating model, governance and team design
• CISO and executive decision support
• Board-level cyber-risk reporting, KPIs and KRIs
• Due diligence for M&A and investment
• Investment cases, sequencing and transformation priorities

Audit & Compliance

ISO 27001, SOC 2, GDPR and other requirements mapped to a coherent control environment, with gaps prioritised and remediation focused on real risk.

• ISO 27001 gap assessment, ISMS and certification readiness
• SOC 2 readiness, control design and evidence preparation
• GDPR technical and organisational measures review
• NIS2, DORA and other regulatory requirement mapping
• Unified control mapping across overlapping requirements
• Risk-prioritised remediation planning with ownership

Application Security

Secure architecture, threat modelling, design reviews, code and pipeline assessment — from identifying weaknesses to implementing effective controls with engineering teams.

• Security architecture, threat modelling and secure design review
• Source code review, manual and tool-assisted
• CI/CD pipeline and supply chain hardening
• Secrets management and dependency governance
• SAST / DAST / SCA tooling selection and tuning
• Secure SDLC rollout and practical control implementation with engineering teams

Penetration Testing

Targeted and full-scope testing across applications, infrastructure, identity, automation and agentic systems — validating exploitable weaknesses and realistic attack paths.

• External and internal infrastructure testing
• Web, API and mobile application testing
• Identity, automation and machine-identity attack paths
• Agentic workflow, tool-abuse and privilege-escalation testing
• Red team and assumed-breach scenarios
• Retest and remediation verification included

Salesforce Security

Advanced Salesforce security across permissions, Transaction Security, Connected Apps, Splunk detection engineering, modular IP filtering and custom controls tailored to real business use cases.

• Effective permission, sharing and access-scope analysis
• Advanced Transaction Security policies for specific use cases
• Connected Apps, OAuth, API and service-account risk review
• Apex, Lightning, Flow and automation security review
• Modular IP filtering architecture and advanced access controls
• Splunk integration and Salesforce-specific detection rules

Monitoring & Threat Intelligence

Continuous monitoring for leaked credentials, API keys, tokens and exposed secrets across dark web sources, public repositories and the wider external environment.

• Credential and identity exposure monitoring
• API key, token and secret exposure detection
• Public repository and GitHub monitoring
• Dark web, paste and breach-source surveillance
• Analyst-qualified alerts with actionable context
• Contextual intelligence for security, SOC and engineering teams

Training & Awareness

Turn your teams into security champions through the DevSec Champions platform, bespoke developer challenges, phishing campaigns and practical workshops on real-world threats.

• DevSec Champions platform access, labs and structured learning paths
• Individual and team progression, strengths and weakness visibility
• Identification of emerging security champions
• Bespoke security challenges for developers
• Targeted phishing campaign design and execution
• Threat workshops and real-world attack briefings

AI & Agentic Security

Security for AI systems and autonomous agents — covering identities, permissions, secrets, data access, tool execution and the actions they can perform.

• Agent and LLM application security review
• Machine identity, permissions and blast-radius assessment
• Prompt injection and insecure tool-use testing
• Secrets, data access and retrieval-boundary review
• Automation and workflow security assessment
• AI governance, inventory and production guardrails