Services
What we do
Every engagement ends with two documents: a technical assessment your engineers can act on, and an executive summary that survives a board meeting.
GRC
Twenty services, one consistent way of thinking about assurance: understand the requirement, understand the risk, implement the control, and prove that it works.
- ISO 27001
- ISO 27701
- ISO 42001
- GDPR
- DPDPA
- NIST CSF
- NIST SP 800-53
- SOC 2
- PCI DSS
- HIPAA
- Assurance & Risk
- Business Resilience
- vCISO
Standards (ISO/IEC 27001, 27701, 42001), privacy and data protection (GDPR, DPDPA, PIA/DPIA), security frameworks (NIST CSF, NIST SP 800-53, SOC 2, PCI DSS, HIPAA), assurance and risk services, business resilience, and security leadership.
- Requirement, control, implementation, evidence, risk, action, validation — the same seven steps on every engagement
- Gap assessment, internal audit, risk assessment and third-party risk as distinct services, not one bundled review
- Business impact analysis, continuity plans and mock tests, so resilience is exercised rather than documented
- GRC toolkits, AI-assisted analysis and PlyoGRC, so registers stay controlled records rather than spreadsheets that go stale
VAPT
A comprehensive testing approach that identifies vulnerabilities and actively exploits them to assess real security posture.
Testing covers web and mobile applications, APIs, networks, thick clients, Active Directory, cloud platforms and OT environments. Findings arrive with proof, business impact and a remediation path, not just a scanner list.
- Black box, grey box and white box engagements
- Aligned to OWASP, PTES, NIST SP 800-115 and CIS benchmarks
- Technical report and executive summary, not one or the other
- Retesting after remediation
Configuration Review
Identifying optimal configurations against CIS benchmarks, because most breaches trace back to misconfiguration rather than an unknown flaw.
Reviews cover firewalls, endpoints, switches, Microsoft 365, Google Workspace, MDM, DLP, backup, Active Directory, PAM, IAM, CASB, SASE and SAP.
- Benchmark comparison against CIS and vendor hardening guides
- Gap analysis with prioritised remediation
- Platform-specific hardening runbook
- Retest to confirm closure
Red Teaming
Simulating real-world attack scenarios to test whether security measures hold under an adversary who is trying, not a checklist.
Engagements run against cloud, infrastructure and people, and increasingly against AI systems — LLM applications, agent tooling and the trust boundaries between them.
- Mapped to MITRE ATT&CK and, for AI systems, MITRE ATLAS
- Full red team, purple team or assumed breach
- Attack path narrative with executive briefing
- Detection gap matrix for the blue team
Phishing Simulation & Awareness
The human layer is the largest attack surface. We measure it, then improve it.
Campaigns run as a baseline, followed by targeted training and a repeat campaign, so the result is a trend rather than a single score.
- Mass phishing, spear phishing, vishing and QR-code campaigns
- Per-user susceptibility scoring and department heatmaps
- Role-based awareness content
- Executive dashboard with longitudinal measurement
Incident Response & Ransomware Recovery
When an incident is live, the priority is containment and getting the business back — analysis comes after.
Containment, eradication, recovery and forensic analysis, following the NIST SP 800-61 lifecycle. Ransomware work includes backup validation, decryption feasibility and clean rebuild guidance.
- 24×7 emergency contact
- Containment and eradication
- Forensic timeline and root cause analysis
- Board-level readout after the incident
Vulnerability Fixation
Finding vulnerabilities is the easy part. Most assessments produce a backlog rather than a fix.
Validation, prioritisation and remediation carried out with your teams or directly, then verified by retest so closure is evidenced rather than assumed.
- Finding validation and false-positive removal
- Risk-based prioritisation
- Remediation support or direct implementation
- Verification retest and closure reporting
Key benefits
What you get out of it
- Proactive alerts that prevent downtime and expensive data theft
- Vulnerabilities prioritised by criticality, so remediation has an order
- Better decision-making for effective risk management
- Regulatory and compliance requirements met
- Operational and programming errors identified before they are exploited
- Countermeasures recommended, not just problems listed
Not sure which of these you need?
A scoping conversation costs nothing and usually narrows it in twenty minutes.