Services
Cyber security
services
Six service lines covering the full arc: finding the weaknesses, proving what they are worth to an attacker, fixing the cause, and demonstrating control to the people who ask for it.
Penetration Testing
Manual, methodology-led testing of web applications, APIs, internal and external infrastructure, cloud environments and mobile apps. Every finding comes with evidence, its confirmation status and the business consequence, not just a CVSS number.
Penetration testing → 02Security Audits
A structured assessment of your controls, architecture, configuration and policy against a recognised framework. You get a gap analysis you can hand to a board and a remediation roadmap you can hand to engineering.
Security audits → 03Incident Response
Help when something has already gone wrong: triage, containment, eradication, recovery and an honest post-incident review. Plus the readiness work — playbooks, logging, tabletop exercises — that decides how the bad day goes.
Incident response → 04Compliance Consulting
ISO 27001, GDPR, PCI DSS, SOC 2 and NIS2. Gap analysis, control design, documentation and evidence, and support through the certification or assessment itself — built so the controls survive after the auditor leaves.
Compliance consulting → 05Security Awareness Training
Training built around what each group is actually exposed to: phishing and social engineering for staff, secure coding for developers, fraud and impersonation for executives. Measured on behaviour, not on completion rates.
Awareness training → 06Managed Security Services
Ongoing monitoring, vulnerability management and advisory support for organisations that need a working security function without hiring a whole team to run one. Including virtual CISO engagements.
Managed security →Choosing
Which service do you need?
A short guide to the question we get asked most often, before anyone has decided what to buy.
| If your situation is… | Start with | Why |
|---|---|---|
| A customer or insurer is asking for evidence of testing | Penetration testing | Produces a dated, independent report against a defined scope — the artefact procurement teams and insurers actually ask for. |
| You are about to launch a new application or major release | Penetration testing | Finds exploitable flaws while there is still time and budget to fix them, rather than after they are load-bearing. |
| You do not know what your overall exposure is | Security audit | Breadth before depth. An audit maps the whole estate and its controls so testing effort goes where it matters. |
| You need ISO 27001, SOC 2 or PCI DSS | Compliance consulting | Certification is a programme with a required order of operations. Doing it out of order is a common cause of delay. |
| Something is happening right now | Incident response | Containment decisions taken in the first hours determine both the damage and whether you can prove what happened afterwards. |
| Your people keep clicking things they should not | Awareness training | Technical controls cannot fully compensate for a workforce that has never been shown what an attack looks like. |
| You have findings but nobody to keep on top of them | Managed security | Assessment produces a backlog. Managed services are what turn that backlog into a steadily shrinking one. |
Next step
Talk to a security consultant
Tell us what you are building, defending or certifying. We will tell you plainly what we would test first, what it takes, and whether you need us at all.