§Approach
Three capabilities.
One shape, cut to fit.
How the practice works. Assess, Build, Advise: what each one looks like, what you leave with, and how a first week starts. Not a tiered menu. A shape we cut to fit the engagement in front of us.
A security assessment across the service areas that matter to the engagement. Most commonly this is Application & API Security, Cloud & Infrastructure, or a Security Assessment covering multiple domains. We start with a scoping conversation to understand what you're building, what compliance target is ahead, and what's already been done. Then we combine static analysis, cloud configuration review, and identity/access audit against what we find. No black-box guesswork; we work alongside your team, with your access.
- Numbered findings register with severity, evidence, and remediation guidance
- Executive summary written for a non-technical reader
- Technical appendix with reproducible steps for engineering
- Recorded walkthrough call with your team
- Optional: help closing the critical and high findings
Start: scoping call, access setup, code repository tour. Then: automated scanning setup, initial cloud configuration review. Once we have findings: triage and priority ranking with your team.
A structured security program build-out anchored to a compliance target: SOC 2 Type II, ISO 27001, UK GDPR, or a Security Readiness need driven by customer requirements. We start where the last audit left off, or where nothing exists. The program is designed collaboratively so your team learns as we build; what we hand over stays running after we leave. Progress reviews throughout, no surprises.
- Complete policy stack adapted to your operating context
- Control framework mapped to your target (SOC 2 CC, ISO Annex A, or equivalent)
- Evidence collection process and reusable templates
- Remediation roadmap for what's outstanding at handoff
- Team enablement, including documentation and light-touch training
- Regular progress reviews, recorded and archived
Start: kickoff and current-state audit. Then: policy stack draft, priority-order the controls. Once controls are prioritised: first assessments, remediation prioritisation, roadmap first pass.
An ongoing partnership after or alongside the program. The practice serves as your security team lead, with regular strategic reviews that keep the program healthy as the company grows. Incident-response preparedness means you don't figure it out under pressure.
- Regular office hours
- Regular program health reviews and roadmap adjustments
- Incident-response playbook plus regular readiness drills
- Compliance renewal support for SOC 2 Type II re-audit and ISO surveillance
- Board-level security reporting when the room needs it
- Escalation call for the first hour of any active incident
Start: onboarding, systems familiarisation, current-state review. Then: first strategic review, priority setting. Once priorities are set: regular leadership check-ins, cadence established.
Three engagement types. Different engagements combine them differently. A program build-out often starts with an assessment. Ongoing advisory usually follows a program. Sometimes a single assessment is all that's needed; sometimes a five-year advisory partnership begins after one intense week.
We scope engagements to what the work needs, not what a tiered pricing sheet says.
Not a sequence. A shape we cut to fit.
Talk to us
Ready when you are. Open for engagements.
An intro conversation to talk through your situation. We'll ask about your stage, your compliance target, and what forced the conversation. Then we tell you honestly whether we're the right fit.