Hands-on security work,
scoped to your risk.
No resold scanner output and no generic checklists. Each engagement is scoped with you, performed by hand, and delivered with the evidence and the context you need to fix what matters first.
Source code audit
Scanners find patterns; auditors find intent that went wrong. We read the code paths an attacker would care about — how identities are established, how permissions are checked, where untrusted data crosses a trust boundary — and verify each suspicion with a proof of concept.
Reviews cover web back-ends, APIs, CLI tools, libraries and embedded components. Findings reference the exact file and line, explain the root cause and come with a concrete fix your developers can apply.
What we look at
- Authentication, session and authorisation logic
- Injection, deserialisation and input handling
- Cryptography misuse and secrets management
- Memory safety, concurrency and unsafe code
- Dependency and supply-chain exposure
What you receive
- Findings mapped to CWE and OWASP ASVS requirements
- Fix guidance with code-level examples
- Optional secure-design review of the architecture
- Verification of fixes (retest) in the same portal
Penetration testing
Every engagement starts with a scope and rules of engagement you sign off. Testing then follows the PTES phases and the OWASP Web Security Testing Guide, combining tooling with manual exploitation to find what automated scans miss: business logic flaws, broken access control and chained weaknesses.
Findings are published to your portal as they are confirmed, so critical issues never wait for the final report. Each one comes with reproduction steps, impact in business terms and a prioritised remediation.
What we look at
- Web applications and single-page apps
- REST and GraphQL APIs, mobile back-ends
- External perimeter and exposed services
- Internal network and segmentation testing
- Grey-box testing with authenticated roles
What you receive
- Live findings in the client portal during testing
- Exploitability graph linking related findings
- Executive summary and technical report (PDF)
- Retest of fixed findings
Network implementation
A network designed by someone who breaks into networks for a living. We plan segmentation around what actually needs to talk to what, deploy UniFi gateways, switches and access points, and lock down management interfaces from day one.
You receive the full documentation: topology, addressing plan, firewall rules and their rationale, and an operations checklist. Optionally, we test the result the way an attacker on your guest Wi-Fi would.
What we look at
- VLAN segmentation and zone-based firewalling
- Site-to-site and remote-access VPN (WireGuard)
- Wi-Fi with WPA3, guest isolation and RADIUS
- Hardened management plane and firmware policy
- Documentation and handover
What you receive
- Network design and addressing plan
- Deployment and configuration of UniFi equipment
- Firewall policy documented rule by rule
- Post-deployment segmentation test
Not sure which one you need?
Describe the system and what worries you. We will suggest the smallest engagement that answers the question.
Talk it through