Capability
Our Services
Three of these are attacks under agreed rules. The fourth is what we do once something has already happened. All of them start with the same call.
-
Forty minutes
Every engagement starts with the same call, at no cost.
-
Nine a year
About as much as seven people can do carefully.
-
Ninety days
We come back, try the same routes, and write down what held.
Full-scope red team
Adversary simulation
An attack against your live estate rather than a copy of it. You set the rules; we work from the outside in and record the route as we go, including the parts that did not work.
-
Every route written down, including the ones that failed.
-
Rules of engagement agreed before we start, and not changed mid-way.
-
Timestamps you can match against your own logs.
Web, mobile and API
Application testing
Review of the surfaces your customers touch. We read the source where you can share it, because a good deal of what matters is not visible from outside.
-
Something you can reproduce for every finding.
-
A patch or a pull request where the fix is ours to write.
-
The pattern behind it, so the fix is not limited to one place.
Tenancy and trust chains
Cloud and identity theft
AWS, Azure and GCP review: role chains, trust boundaries, and credentials that outlived whoever issued them. In most estates identity is where the real boundaries are, and it is rarely mapped.
-
The role chains that reach production, mapped.
-
CI/CD treated as production, whatever the diagram says.
-
Findings sent as pull requests against your infrastructure code.
After the fact
Digital forensics
Something has happened and nobody can say exactly what. We reconstruct it from whatever evidence survived, and say how confident we are at each step.
-
A timeline built from artefacts, not from assumptions.
-
Chain of custody kept from the first image onward.
-
What we could not establish, said plainly rather than filled in.
They found a way in during the first week and spent the rest of the engagement establishing how far it went. The report went to our board without editing, which is not something we can usually say.
Every engagement
The same either way.
These apply to any of the four. They are not options and they are not priced separately.
-
Named operators
You know who will be working on your systems before we start. We do not subcontract and we do not substitute people mid-engagement.
-
NDA first
Nothing technical is discussed until one is signed. We can send ours or work from yours.
-
Working proof
If we cannot demonstrate it, it is not written up as a finding. Anything we suspect but could not show goes in an appendix, marked as such.
-
Ninety-day retest
We try the same routes again at ninety days and write down what happened. A fix that holds at ninety days is a fix.
-
Three summaries
Security, engineering and leadership each get a version written for them, so nobody has to translate for anyone else.
-
Your data stays yours
Evidence is held encrypted for the retest window and destroyed afterwards, with written confirmation.
Not sure which one applies?
Most people are not sure, and working that out is what the call is for. Forty minutes, at no cost. If it is not a job for us we will say so.