Services
Find it before somebody else does.
Security work is cheapest when it is continuous and most expensive when it is a surprise. We run it as part of delivery — threat models at design time, automated scanning in the pipeline, and a review before anything with consequence ships.
We also run it as a standalone service for teams who built elsewhere and now need an independent opinion: application penetration testing, cloud configuration review, smart-contract audit preparation and a remediation plan with effort estimates attached.
On the compliance side we do the engineering half of the work — the evidence, the controls, the documentation — so your auditor and your legal counsel are arguing about paperwork rather than about your architecture.
Capabilities
Manual review plus tooling across the surfaces that actually get attacked: authentication, authorisation, tenancy boundaries and the integration layer.
Time-boxed, scoped testing against a staging environment, reported in a format your customers' security questionnaires will accept.
Static analysis, invariant testing and internal review that removes the findings you should never have paid an external auditor to discover.
A newer surface with old failure modes. We test what the model can be talked into and what it can reach when it gets there.
Testing that runs without a human remembering to run it, on every commit, with results a product manager can read.
The technical evidence behind the certificate: logging, access control, data mapping, retention and the documentation to prove it.
Deliverables
Stack
Chosen per engagement, not by habit. If your team already runs something else and it works, we work in it rather than around it.
Staffed by
Every engagement in this practice is delivered by a named team you interview yourself — designed, hired and led through our team-building practice.
See the peopleEngagement
Indicative starting figures for a typical engagement, excluding VAT. Your actual number comes from a written scope — but it will be in the same neighbourhood.
An independent opinion before a launch or a raise.
Getting evidence-ready for ISO 27001 or SOC 2.
Keeping the pipeline and the posture healthy.
Often combined with
Web platforms, internal tools and APIs built to be maintained for years — type-safe, observable, accessible and fast enough that nobody notices the infrastructure.
ExploreSmart contracts, wallets, indexers and token infrastructure — engineered for the standard that applies when code holds other people's money.
ExploreAssistants, retrieval systems and workflow automation built on Claude, OpenAI and open models — with the evaluation harness, guardrails and cost controls that make them safe to put in front of customers.
ExploreGet started
Send us the situation as it actually is. You get back a shaped engagement, a named team, a fixed timeline and a number you can put in front of a board.
A partner replies within one business day — with questions, not a sales sequence.