Security projects · Contract & white label
Work with a defined scope, a defined end, and a report you can act on.
Some security work is a project, not a subscription. An assessment before a funding round. A supplier questionnaire backed by evidence. A cloud review before you scale. We take that work directly from businesses, and we take it on contract from other providers who need a specialist or an extra pair of hands.
Security assessment
A structured review of what an attacker can reach and what they could do with it. We look at your external attack surface, your web applications, your email security and your key configuration, then map the findings to whichever framework you answer to, so the output is a prioritised plan rather than a vulnerability dump.
What we look at
- External attack surface and subdomain exposure
- Web application review against the OWASP Top 10
- Email security: SPF, DKIM, DMARC and spoofability
- DNS configuration and domain health
- Key hardening and configuration gaps
- Framework gap mapping against the standard you are held to
What you receive
- An executive summary written for people who are not engineers
- Risk rated findings with reproduction steps for each one
- Remediation guidance that names the actual fix
- A walkthrough session, so nobody is left decoding a PDF
Supplier security assurance
When your clients ask for proof.
Supplier questionnaires, practical policies, evidence reviews and IT health checks. We help you describe your security accurately and plan the improvements that matter.
Explore security assurance →Cloud security review
Cloud breaches rarely come from one dramatic mistake. It is an over-broad role, a bucket somebody opened for a migration and forgot, a logging gap that means nobody would know. We review AWS, Azure or GCP against the paths an attacker would actually take, not just a compliance checklist.
Covered
- Identity, roles and privilege escalation paths
- Storage exposure across S3, Blob and GCS
- Network security groups and firewall rules
- Encryption in transit and at rest
- Logging, monitoring and alerting gaps
- Secrets management and credential exposure
Platforms
- Amazon Web Services
- Microsoft Azure
- Google Cloud Platform
- Mixed and multi-cloud estates
Contract and white label
For MSPs, IT providers, consultancies and brokers.
You have the client relationship and you intend to keep it. What you do not have, on this particular job, is security assurance expertise or extra assessment capacity. We work behind you: contracted to you, reporting in your format, invisible to your client unless you want us introduced. This is a large part of what we do, and it is set up properly rather than improvised per job.
What we take on
- Supplier questionnaires, assurance evidence and policy work
- Threat hunting across an estate you manage
- Overflow assessment and reporting work
- Scoped technical investigation and reporting
- Second opinion on a finding you are unsure of
How we contract
- You stay the prime. Our agreement is with you
- A master agreement signed once, then a short scope per job
- Wholesale rates, so there is margin left in it for you
- Monthly in arrears, with no pay-when-paid condition
What protects you
- Our own professional indemnity and cyber liability cover
- Certificate of currency for your vendor onboarding
- Documented chain of custody on anything we handle
- Data minimisation, so client material stays where it should
- Confidentiality that survives the end of the engagement
Investigation support, by arrangement
We consider selected incident investigation and digital forensics engagements, directly or alongside your existing IT provider. Scope, availability and any access are agreed before work begins. Emergency response and ongoing incident handling are not part of this service.
How an engagement runs
Scoping call
A conversation about your environment, what is prompting this, and what a good outcome looks like. No agreement needed to have it.
Written scope
A short statement of work: what is in, what is out, what you receive and what it costs. Nothing starts before it is signed.
The work
We keep you informed as we go rather than disappearing until the report. Anything critical is raised the day we find it.
Report and walkthrough
A written report, then a session to talk through it. We answer questions until you are confident about what to do next.