Identity and access.
Design least privilege, authentication, segmentation and credential handling. Keep ownership and access review explicit.
Cyber security reviews and engineering
Security across the system. From access to recovery.
Understand who can reach your data, where an attack could spread and how you would respond. We review, design and test controls across identity, infrastructure, applications and AI, with responsibilities and remaining risks made clear.
Since the 2000s Design the boundary into the platform.
Talk to an engineer Start with a scoped reviewEngineering focus
01Map the threat
02Design the controls
03Test and review
Possible applicationHealthcare & medical
Map access to operational records across staff, services and an AI workflow. Separate reading from making changes, test denied access and record who can approve exceptions. Explore this sector.
Start with what can actually happen.
Identify the systems and information at risk, then map access, data flows and permitted actions. Agree the controls with the people responsible for operating and reviewing them.
Detection and readiness.
Collect useful telemetry, tune detection and prepare response procedures. Test containment and recovery with the relevant teams.
AI and application security.
Review trust boundaries, prompt-injection exposure, tool permissions and data handling. Enforce controls outside the model.
We document the scope, assumptions, controls and remaining risks so you can see what has been addressed and what still needs attention.
Reference architecture
Layered controls, from sign-in to recovery.
Use overlapping controls so that one failure does not remove the whole defence. Choose and test them against the threats and systems in scope.
Identity
Phishing-resistant sign-in, least privilege and just-in-time admin.
- Multi-factor authentication
- Conditional Access
- Privileged Identity Management
- How it fails
- A phished or reused password, or an account with permanent administrative privileges.
- What holds it
- Phishing-resistant sign-in, Conditional Access policies and time-limited privileged access.
Devices
Device compliance, endpoint detection and disk encryption.
- Intune compliance
- EDR
- Disk encryption
- How it fails
- An unmanaged or unpatched laptop signs in with perfectly valid credentials.
- What holds it
- Compliance checks before access, endpoint detection and disk encryption, with exceptions and coverage made explicit.
Email and collaboration
Authenticated mail, filtered links and controlled sharing.
- SPF, DKIM and DMARC
- Safe Links and Attachments
- Sharing controls
- How it fails
- A convincing message from a spoofed domain, a malicious link, or a file shared far wider than intended.
- What holds it
- Authenticated mail with an enforced DMARC policy, links and attachments checked when they are opened, and sharing that is scoped and expires.
Data
Sensitive information labelled and kept inside its boundaries.
- Sensitivity labels
- Data loss prevention
- Retention
- How it fails
- Sensitive information copied, forwarded or uploaded somewhere it should never go.
- What holds it
- Sensitivity labels, data loss prevention at the boundaries, and retention set for the agreed business and legal requirements.
Detection and response
Alert triage on an agreed schedule. Playbooks rehearsed before they are needed.
- Defender XDR
- Alert triage
- Incident playbooks
- How it fails
- An alert that fires into a queue nobody reads, or a response nobody has practised.
- What holds it
- An agreed triage schedule, clear escalation responsibilities and response playbooks rehearsed against relevant scenarios.
Recovery
Backup copies protected from production access.
- Immutable backup
- Restore tests
- Emergency access
- How it fails
- Backups deleted or encrypted by the attacker, or restores that have never been tested.
- What holds it
- Use separately controlled immutable copies, with protection and retention set for the agreed threats. Time representative restores against recovery objectives and rehearse emergency access under agreed failure scenarios.
Trust by design
Know what you are relying on.
Understand the system, define the controls and test the assumptions.
Identity & authority.
Name the users, agents and service owners. Scope access, manage credentials and provide a way to revoke permissions.
Data & boundaries.
Map sources, processing locations and retention. Check the complete data path, including logs, tools and fallback providers.
Change & validation.
Record important decisions, keep changes under version control and evaluate behaviour against agreed requirements.
Execution & isolation.
Validate tool inputs and constrain network and runtime access. Use human approval where the consequences call for it.
Operation & recovery.
Agree monitoring, escalation, backup, recovery and third-party responsibilities before the service goes live.
Evidence & review.
Make controls and their limitations inspectable. Review the system when data, models, risks or business requirements change.
Controls, hosting choices and service commitments are agreed for each engagement. Ask us for the assurance information relevant to your project, and we’ll walk you through the evidence behind it.
Found a vulnerability in one of our own systems? Our security.txt file explains how to report it.
A closer look
Good questions. Straight answers.
Does security only apply to the AI layer?
No. Identity, networks, applications, data and people all shape the security of the system.
Do you provide compliance certification?
We design and test the technical controls and prepare you for the assessment. The certificate itself comes from an accredited certification body, which keeps the assessment independent.
The first step
Make the risks and controls explicit.
Start with a conversation about the systems or data you need to protect. We scope a review of access, data flows, controls and response arrangements around the risks that matter to you.
What you get. Documented findings, prioritised improvements and the remaining risks to consider when deciding what to do next.
Talk to an engineer