Practice
Four disciplines. One standard.
We take a limited number of engagements per year. Every one of them is scoped personally, delivered quietly, and measured by what it prevents, not what it produces.
Adversary Simulation
Penetration testing, red-teaming, purple-teaming and assumed-breach operations tailored to your actual threat model — not a generic one. We replicate the adversaries you are likely to meet, with restraint, and we brief your defenders as we go or at the end, as you prefer.
- Penetration testing (application, network, cloud, mobile)
- External & internal red-team engagements
- Assumed-breach & ransomware tabletop exercises
- Detection validation & detection engineering
Architecture, Hardening & Policy
We shape systems so intrusion is unprofitable and detection is inevitable. We review cloud estates, engineering workflows and boundary designs, and write the policies that hold them together — policies meant to be followed, not filed. We leave you with changes you can maintain without us.
- Cloud security review (AWS · GCP · Azure)
- SDLC, supply-chain & CI/CD hardening
- Security policy & standards authorship
Board & Executive Counsel
We prepare executives for board conversations, translate technical risk into decisions the business can actually act on, and offer steady counsel on priorities.
- Security leadership on retainer or for a defined term
- Board briefings & regulator preparation
- Independent security review ahead of acquisitions or investments
- Crisis support
Awareness & Secure Development
The habits that make the rest of our work less necessary over time. Security awareness for everyone, secure development for engineers — taught by practitioners, not slide decks.
- Security awareness programmes, tailored by role
- Secure development coaching (threat modelling, code review)
- Phishing drills, tabletop exercises & developer training
Retainer
A recurring, personal relationship. Most of our clients begin here, or arrive here within a year. Priced annually.
Fixed engagement
A defined piece of work, a defined outcome. Ideal for red-team exercises, architecture reviews and programme design.
Counsel hour
Sometimes an afternoon of honest conversation is worth more than a quarter of work. Available to qualifying organisations.