§Approach
Three capabilities.
One shape, cut to fit.
How the practice works. Assess, Build, Advise — what each one actually looks like, what you leave with, and how a first week starts. Not a tiered menu. A shape we cut to fit the engagement in front of us.
A security assessment across the service areas that matter to the engagement — most commonly Application & API Security, Cloud & Infrastructure, or a Security Assessment covering multiple domains. We start with a scoping conversation — what you're building, what compliance target is ahead, what's already been done. Then we combine static analysis, cloud configuration review, and identity/access audit against what we find. No black-box guesswork; we work with your team and your access.
- Numbered findings register — severity, evidence, remediation guidance
- Executive summary written for a non-technical reader
- Technical appendix with reproducible steps for engineering
- Walkthrough call with your team, recorded
- Optional: help closing the critical and high findings
Start: scoping call, access setup, code repository tour. Then: automated scanning setup, initial cloud configuration review. Once we have findings: triage and priority ranking with your team.
A structured security program build-out anchored to a compliance target — SOC 2 Type II, ISO 27001, UK GDPR — or to a Security Readiness need driven by customer requirements. We start where the last audit left off, or where nothing exists. The program is designed collaboratively — your team learns as we build, so what we hand over stays running after we leave. Progress reviews throughout; no surprises.
- Complete policy stack — adapted to your operating context
- Control framework mapped to your target — SOC 2 CC, ISO Annex A, or equivalent
- Evidence collection process and reusable templates
- Remediation roadmap for what's outstanding at handoff
- Team enablement — documentation and light-touch training
- Regular progress reviews, recorded and archived
Start: kickoff and current-state audit. Then: policy stack draft, priority-order the controls. Once controls are prioritised: first assessments, remediation prioritisation, roadmap first pass.
Ongoing partnership after — or alongside — the program. The practice serves as your security team lead, with regular strategic reviews that keep the program healthy as the company grows. Incident-response preparedness means you don't figure it out under pressure.
- Regular office hours
- Regular program health reviews and roadmap adjustments
- Incident-response playbook + regular readiness drills
- Compliance renewal support — SOC 2 Type II re-audit, ISO surveillance
- Board-level security reporting when the room needs it
- Escalation call — the first hour of any active incident
Start: onboarding, systems familiarisation, current-state review. Then: first strategic review, priority setting. Once priorities are set: regular leadership check-ins, cadence established.
Three engagement types. Different engagements combine them differently. A program build-out often starts with an assessment. Ongoing advisory usually follows a program. Sometimes a single assessment is all that's needed — sometimes a five-year advisory partnership begins after one intense week.
We scope engagements to what the work actually needs, not what a tiered pricing sheet says.
Not a sequence. A shape we cut to fit.
Talk to us
Ready when you are. Open for engagements.
An intro conversation to talk through your situation. We'll ask about your stage, your compliance target, and what forced the conversation. Then we tell you honestly whether we're the right fit.