Security work that produces fixes, not a 90-page PDF
A penetration test you cannot act on is an expensive way to feel reassured. We deliver findings with a severity rating, a concrete fix, the code to implement it, and a retest to confirm it worked — and we would rather spend the budget on remediation than on more findings. For regulated clients we map the work to the evidence your auditor actually asks for.
Engagement
Audits run as fixed-scope 1–3 week engagements with a defined scope and rules of engagement agreed in writing. Remediation is quoted separately and typically smaller than the audit.
What you get
Deliverables, not adjectives
This is what lands in your hands at the end. If something is missing from this list, it was not in scope — and we will say so before we start rather than after.
OWASP Top 10 and ASVS-aligned testing of your web and mobile applications
Infrastructure review: identity and access, network exposure, patching, logging and secrets handling
Findings with severity, exploitability, a concrete remediation path, and the code to implement it
A retest after remediation, so you can evidence the fix rather than assert it
GDPR technical measures and a data map to support your privacy notice
ISO 27001 and Cyber Essentials readiness: control gap analysis and evidence you can hand an auditor
A prioritised remediation plan split into must-do, should-do and nice-to-have, with effort estimates
When to call us
The situations where this is the right conversation
If you recognise one of these, that is probably enough to justify a 30-minute call.
01
You need to pass a procurement questionnaire
Enterprise customers and public tenders increasingly require Cyber Essentials or ISO 27001. We do a control gap analysis, implement the missing controls, and leave you audit-ready with the evidence packaged.
02
You are worried about a breach but do not know where to start
We start with a scoped review: what data you hold, where it lives, who can reach it, and what would actually be damaging. You get a ranked list of what to fix first, in plain language.
03
You have had a penetration test and cannot act on it
Send us the report. We will re-brief it against your real risk, implement the fixes, and retest — usually for a fraction of the cost of a new engagement.
04
You handle personal data and are not sure you are compliant
GDPR is as much an engineering problem as a legal one. We map the data, implement the technical measures, and produce the evidence trail alongside your lawyer's paperwork.
How we build it
The tools we would reach for
Not a shopping list. These are what we would actually pick for this kind of work, and we will tell you if a different tool fits your constraints better.
- Burp Suite
- OWASP ZAP
- Semgrep
- Trivy
- Checkov
- Vault
- AWS IAM
- Falco
- CrowdStrike
- SIEM
Examples
The shape of work this usually turns into
Illustrative scenarios, kept anonymous. Specific case studies with client names and evidenced metrics appear on our work page as clients approve them.
OWASP retest and remediation
Took over an existing report that had produced no fixes in a year. Re-scoped it to real business risk, remediated the genuine issues, and produced a retest report the client's enterprise buyers accepted.
- OWASP
- Remediation
- Retest
ISO 27001 readiness for a growing SaaS
Control gap analysis across 17 domains, implemented the missing technical controls, and assembled the evidence pack. Passed at first audit without a major non-conformance.
- ISO 27001
- Evidence
- Audit support
Hardening a fast-growing AWS estate
Found over-privileged IAM roles, unencrypted data stores and long-lived access keys in active use. Remediated, moved to short-lived credentials, and added the detection that would have caught it.
- AWS IAM
- Encryption
- Secrets
Questions
Cybersecurity: what buyers ask
Straight answers, including where the answer is that you probably do not need this.
Frequently, yes. We do a gap analysis against whatever you are being asked for — Cyber Essentials, ISO 27001, or a customer's own supplier questionnaire — and implement the controls that are missing.
No. If your contract requires an accredited provider, tell us and we will work alongside one rather than claim accreditation we do not hold.
A penetration test tries to break specific things and proves what is exploitable. An audit is broader and measures whether your controls work across the whole estate. Most clients need the audit first, and a targeted test after remediation.
Standard. Agreed scope, agreed testing window, agreed contacts, in writing before anyone touches a system. We do not test production without written authorisation naming the authorisation window.
Related
Often needed alongside this
Got a cybersecurity project in mind?
Send us the problem and the constraint. You will get a written responsewithin one uk business day, uk hours, 9:00-18:00, monday to friday, and an honest view on whether we are the right fit.