Premium protection
Hands-on testing against the standards attackers and auditors use.
Service 08 of 15
Cybersecurity services
Pen tests, audits and monitoring that keep your product and data safe.
- Typical timeline
- 1–4 weeks
- Pricing
- Fixed quote
- Team
- Security engineer
Our 3 promises
Your safety. Our goal.
Three promises we make on every security project.
One step ahead
Gaps found and fixed before launch, not after.
Clear answers
Plain-language reports and a retest after every fix.
Tech stack
The stack behind your cybersecurity services
Proven, well-supported tools at every layer. Picked for your product, never for our habits.
- StandardsCyber Essentials
- StandardsMost requestedOWASP Top 10
- TestingOWASP ZAP
- StandardsMost requestedISO 27001
- TestingNmap
- IdentityMFA
- TestingMost requestedBurp Suite
- IdentityOkta
- IdentityMost requestedSSO
- IdentityEntra ID
- MonitoringCloudTrail
- MonitoringMost requestedSIEM
- MonitoringGuardDuty
- ComplianceMost requestedGDPR
- ComplianceSOC 2 readiness
What’s included
What you get
Everything in scope, from first workshop to launch.
01StartSecurity review
Code and architecture review for common risks.
Read more +Show less −
A security review is a check of your code, configuration and architecture for common risks, such as those in the OWASP Top 10. You get a threat model and a prioritised report with clear fixes, usually within 1–2 weeks. It is a sensible first step before a formal penetration test.
What you get
- Threat model showing what could go wrong and where
- Code review of login, permissions and data handling
- Dependency scan for known vulnerable libraries
- Cloud permissions and configuration check
- Prioritised report with plain-language fixes
How it works
- Agree scope and get read-only access to code and cloud
- Map how data flows and build the threat model
- Review code, dependencies and configuration
- Walk you through the report and agree priorities
Good to know: Fixing what a review finds before a formal pen test usually makes the test shorter and the report cleaner.
02TestPenetration test
Hands-on testing of your app and infrastructure.
Read more +Show less −
A penetration test is hands-on testing of your web app, APIs and cloud setup to find weaknesses an attacker could use. Testing usually takes 1–3 weeks, and serious findings are shared as we go rather than at the end. Where customers, insurers or tenders need independent testing, accredited partners run the formal pen test and we coordinate it.
What you get
- Written test scope, rules and testing window
- Web and API testing using Burp Suite and OWASP ZAP
- Cloud and network checks, including Nmap scans
- Immediate alerts for any critical findings
- Report with risk ratings, evidence and fix advice
How it works
- Agree scope, rules and what is off limits
- Test a staging copy or an agreed live window
- Share critical issues straight away
- Deliver the report and talk through each finding
Good to know: Testing a staging environment with realistic test data avoids any risk to your live customers.
03BuildFixes
We fix what we find, or help your team fix it.
Read more +Show less −
Fixes means we resolve the issues found in a review or test directly in your code and infrastructure, or guide your team to do it. Every fix is ranked by risk, critical issues come first, and each one is retested to confirm it works. Because we are a development team, findings do not sit unresolved in a report.
What you get
- Fix plan ordered by risk and effort
- Code and configuration changes, reviewed and tested
- Updated dependencies and patched libraries
- Retest of every fix, with evidence
- Updated report showing each issue as closed
How it works
- Rank findings and agree what to fix first
- Fix in short cycles, critical issues first
- Retest each fix and record the result
- Share the closed-out report for customers or insurers
Good to know: If your own developers make the fixes, we pair with them so the same mistakes are not repeated.
04BuildAccess & identity
SSO, roles and secure access for your team.
Read more +Show less −
Access and identity sets up single sign-on, multi-factor authentication and role-based permissions, so each person reaches only what they need. You get SSO through Okta or Microsoft Entra ID and a clear record of who can access what. A typical setup fits within 1–4 weeks, depending on how many systems you use.
What you get
- SSO across your main business and product systems
- MFA switched on for all staff and admin accounts
- Roles and permissions based on least privilege
- Access register showing who can reach each system
- Joiner, mover and leaver process for staff changes
How it works
- List every system, account and current admin user
- Design roles and agree who needs what
- Connect systems to SSO and switch on MFA
- Remove unused accounts and document the process
Good to know: Shared logins are a common gap, so plan for every person to have their own named account.
05GrowMonitoring
Alerts for suspicious activity after launch.
Read more +Show less −
Security monitoring sets up logging and alerts so suspicious activity, such as unusual logins or permission changes, is spotted quickly after launch. You get alerts through tools such as AWS CloudTrail, GuardDuty or a SIEM, plus a simple plan for what to do when one fires. It also helps you show customers and regulators that you log and respond to incidents.
What you get
- Central security logging across apps and cloud accounts
- Alerts for unusual logins, access changes and suspicious traffic
- Incident response plan with clear roles and contacts
- Breach response steps in line with UK GDPR reporting
- Regular review of alerts and new risks
How it works
- Agree which events matter and who receives alerts
- Switch on logging and connect alert channels
- Test alerts with simulated events
- Review alerts regularly and retest after changes
Good to know: UK GDPR gives you 72 hours to report certain breaches, so agree who is on call before you need them.
How it works
From idea to launch
Every service runs through the same five steps. Here is what each one means for Cybersecurity services.
01of 05
ScopeWeek 1Once
We agree what to test, the rules and the risks that matter most.
You getTest scope
What we do
- Scoping call with your team
- Agree targets, rules and timing
- Review past incidents and compliance needs
You get
- Signed test scope
- Rules of engagement
- Test schedule
From you
- 1 hour scoping call
- Written permission to test
Tools
- Notion
02of 05
PlanBefore testingOnce
Test plan, threat model and a fixed quote you approve.
You getFixed quote & test plan
What we do
- Threat model of your app and cloud
- Test plan by risk
- Contacts and escalation plan
You get
- Fixed, itemised quote
- Test plan
- Threat model
From you
- Review and approve the plan
- Test accounts and access
Tools
- OWASP
- Jira
03of 05
Test1–3 weeks↻ Repeats
Hands-on testing of your apps, APIs and cloud set-up.
You getFindings as we go
What we do
- Web, API and mobile testing
- Cloud configuration review
- Critical issues reported the same day
You get
- Live findings log
- Same-day alerts for critical issues
From you
- A contact for urgent issues
Tools
- Burp Suite
- Nmap
- ScoutSuite
04of 05
Report & fixAfter testing↻ Repeats
A plain-language report and help to fix every issue.
You getSecurity report
What we do
- Report ranked by risk
- Fix guidance for your developers
- Debrief call with your team
You get
- Executive summary
- Technical report with fixes
- Debrief call
From you
- Fix the issues found
Tools
- Jira
- GitHub
05of 05
Retest & protectOngoing↻ Repeats
We retest every fix and keep watching for new risks.
You getVerified fixes
What we do
- Retest of every fix
- Ongoing scanning and monitoring
- Quarterly security review
You get
- Retest certificate
- Quarterly report
From you
- Quarterly 30-minute review
Tools
- Snyk
- Wazuh
FAQ
Cybersecurity services questions
What is Cyber Essentials?
A UK government-backed scheme covering five basic controls: firewalls, secure configuration, access control, malware protection and patching. We help you prepare; certification is issued by an IASME certification body.
Do I need a penetration test?
If customers, insurers or tenders ask for independent testing, yes. We fix issues first, then coordinate testing with an accredited partner.
What does a security review include?
Code and configuration checks, dependency scanning, cloud permissions, authentication and data protection, delivered as a prioritised report with fixes.
Can you fix the issues you find?
Yes. Because we are a development team, we fix vulnerabilities directly in your code and infrastructure, then re-test.
How does this help with GDPR?
UK GDPR requires appropriate technical security. We document encryption, access control, logging and breach response so you can show it.
Who owns the code?
You do. All IP is assigned to you in the contract, and the code, accounts and documentation are yours from the first sprint.
Let’s talk
Let’s talk
A 30-minute call with an engineer and a clear next step for your project.