Cybersecurity
Securityworkrankedbytheexposureyouactuallycarry.
We combine architecture, identity, vulnerability testing, managed detection and incident response — with separate capacity for client work and protection of our own estate.
- NDPA
- GDPR
- PCI DSS
- ISO/IEC 27001
- NDPA
- GDPR
- PCI DSS
- ISO/IEC 27001
- NDPA
- GDPR
- PCI DSS
- ISO/IEC 27001
Who this is for
The situation that makes this urgent
The mandate and boundaries below come directly from the approved service catalogue.
A vulnerability backlog is ranked by generic severity rather than real exploitability.
Security alerts close without improving detections, telemetry or controls.
Regulatory readiness requires evidence for NDPA, GDPR, PCI DSS or ISO 27001.
Three ways to engage
Assess, Transform, Operate
Each package has a defined duration, retained outputs, commercial model and objective exit criterion.
Assess
Security posture and exposure baseline.
Transform
Security engineering programme.
Operate
Managed detection and response.
Capability detail
The technical substance, on the page and not behind a form
The operating capabilities and controls that define this practice.
Architecture
Threat modelling and control design
Identity
Phishing-resistant access engineering
Assurance
Vulnerability assessment and penetration testing
SOC
Detection engineering and response
Readiness
NDPA, GDPR, PCI DSS and ISO 27001
Recovery
Ransomware recovery validation
Technical standard
Requirements that apply to every engagement
Must and should requirements from the board-approved practice standard, made visible before a conversation.
Enforce phishing-resistant MFA wherever hardware-backed or platform authenticators are available.
Use short-lived, automatically rotated workload identities; static keys are blocking findings.
Version-control threat models for Tier 1 and regulated workloads.
Penetration-test Tier 1 systems before release and annually, with remediation retested.
Rank findings by reachability, active exploitation, blast radius and compensating controls.
Resolve every alert to an outcome and create a tuning or instrumentation action where needed.
Keep internal protection and commercial service staffing, rotas and case tooling segregated.
Report mean time to detect and contain by severity.
Run two annual adversary-emulation exercises for Tier 1 Operate clients.
Validate immutable backup and recovery integrity jointly with infrastructure engineers.
How we work
Four phases. Objective exit criteria.
A gate passed on assertion has not been passed. One exit criterion per gate is shown here; the full set sits on each practice page.
Discover
Workload profile, dependency map and recovery objectives written down and signed off by the client owner.Design
Target architecture reviewed against the vendor-supported pattern for the engine in question; failure modes enumerated.Deliver
Recovery tested from backup within the stated RTO, evidenced by a timestamped test record.Operate
Runbooks in place, rota published, first quarterly service review held with measured figures.
The boundary
What we do not do
A capability list without explicit limits is only marketing.
Prohibited
Offensive operations, retaliation and active countermeasures against third parties.
Legal boundary
We provide facts and timelines; counsel and the Data Protection Officer decide notification.
Independence
Assurance of SOAVM-built systems uses an external provider when independence is required.
Evidence
The artefacts that make the claim testable
Evidence replaces unqualified promises and unattributed metrics.
Exploitability-ranked register
A defensible queue based on the client's actual architecture and controls. Measurement method and review date accompany the delivered record.
Detection coverage record
Technique coverage, alert outcomes, tuning actions and containment times. Measurement method and review date accompany the delivered record.
Get started
A posture assessment gives your board a ranked exposure picture and a costed path to reduce it.
You keep the written baseline whether or not we continue together.