How we work
A disciplined sequence, scaled to the question
Every engagement follows the same five steps, whether it covers one application or an entire environment.
The engagement sequence
- 01
Scope and authorise
We confirm objectives, systems, frameworks and constraints. Testing starts only under written authorisation from an accountable officer.
- 02
Gather evidence
Interviews, configuration reviews, technical testing and document analysis. Ratings rest on what systems show, not what policies say.
- 03
Analyse risk
Findings are rated by likelihood and consequence in your own risk framework, so they fit existing enterprise risk reporting.
- 04
Report and brief
An executive summary, a technical annex and a briefing where decision-makers can test the findings.
- 05
Support uplift
A sequenced roadmap, advice on design and procurement decisions, and retesting to confirm remediation has worked.
What you can expect from us
Need-to-know handling
Findings, evidence and reports are shared only with the people you nominate.
Proportionate advice
Recommendations are sized to your threat environment and resources, not to a generic checklist.
Plain consequences
Every technical finding is translated into its effect on operations, data and legal obligations.