Services
Six practices, one team, one view of your risk.
Most security problems don't stay in one lane. A failed audit turns out to be an architecture problem, and an architecture problem turns out to be a governance one. Our practices share people, methods and a single control model, so the advice you get from one fits with the others.
The practices
Where we spend our time.
01 →
Cyber Strategy & Executive Advisory
Where security should be in two to three years, what it costs, and how to explain it to the people who approve the budget.
01 →
Cyber Strategy & Executive Advisory
Where security should be in two to three years, what it costs, and how to explain it to the people who approve the budget.
02 →
Cyber Governance, Risk & Compliance
Risk frameworks, policies and certification programs that people use day to day, mapped once to every standard you answer to.
02 →
Cyber Governance, Risk & Compliance
Risk frameworks, policies and certification programs that people use day to day, mapped once to every standard you answer to.
03 →
Security Architecture & Risk Modelling
Cloud, identity, network and data designs reviewed against the threats that actually apply to them, with reference patterns your engineers can reuse.
03 →
Security Architecture & Risk Modelling
Cloud, identity, network and data designs reviewed against the threats that actually apply to them, with reference patterns your engineers can reuse.
04 →
Cyber Resilience & OT Security
Keeping essential services running, from recovery planning and executive exercises to securing the industrial systems where IT meets the plant floor.
04 →
Cyber Resilience & OT Security
Keeping essential services running, from recovery planning and executive exercises to securing the industrial systems where IT meets the plant floor.
05 →
Assessments & Control Reviews
Independent maturity assessments and control testing that will stand up in front of an auditor, an assessor or your audit committee.
05 →
Assessments & Control Reviews
Independent maturity assessments and control testing that will stand up in front of an auditor, an assessor or your audit committee.
06 →
Board Reporting & Program Assurance
Risk indicators directors can act on, and independent reviews of security programs that have lost momentum.
06 →
Board Reporting & Program Assurance
Risk indicators directors can act on, and independent reviews of security programs that have lost momentum.
Also available
Leadership, testing and what's coming next.
Full detail →
vCISO
A named senior practitioner who leads security for you part-time, on a monthly retainer.
Full detail →
vCISO
A named senior practitioner who leads security for you part-time, on a monthly retainer.
Request a test →
Penetration testing
Testing scoped around what an attacker would target first, run by our team, with specialist partners for specialised types of test.
Request a test →
Penetration testing
Testing scoped around what an attacker would target first, run by our team, with specialist partners for specialised types of test.
Full detail →
AI security & governance
Reviews of LLM applications and agents, an inventory of the AI in use, and ISO/IEC 42001 readiness.
Full detail →
AI security & governance
Reviews of LLM applications and agents, an inventory of the AI in use, and ISO/IEC 42001 readiness.
Full detail →
Post-quantum readiness
A cryptographic inventory and a migration plan aligned with ASD's end-2030 guidance.
Full detail →
Post-quantum readiness
A cryptographic inventory and a migration plan aligned with ASD's end-2030 guidance.
Why one team
The work hands over cleanly, because nobody changes firm.
One control model
Every engagement maps findings to the same control set, so an architecture review and an ISO audit don't produce two different to-do lists.
One control model
Every engagement maps findings to the same control set, so an architecture review and an ISO audit don't produce two different to-do lists.
One set of people
The practitioner who assessed your controls can brief the one designing the fix. You don't re-explain your environment to each new team.
One set of people
The practitioner who assessed your controls can brief the one designing the fix. You don't re-explain your environment to each new team.
One point of contact
When a test needs a specialist partner, we scope the work, review the output and stay accountable for how it fits into your plan.
One point of contact
When a test needs a specialist partner, we scope the work, review the output and stay accountable for how it fits into your plan.
Not sure which practice you need?
Most clients aren't at first. Describe the situation and we'll point you to the right starting point.
When you need method to the chaos
Your safety is our mission. Your trust is our commitment.
Click below to schedule your free risk assessment and learn how we can help protect your world.
When you need method to the chaos
Your safety is our mission. Your trust is our commitment.
Click below to schedule your free risk assessment and learn how we can help protect your world.
When you need method to the chaos
Your safety is our mission. Your trust is our commitment.
Click below to schedule your free risk assessment and learn how we can help protect your world.