Technical and security consulting

A structured, hands-on review of a web application, API or online service for weaknesses that an attacker could exploit. We work from the position of an outside attacker, an authenticated user, or both, depending on what you need to know.

The assessment follows a defined methodology covering the categories of weakness that account for most real-world compromises of web systems, and is adapted to the specific technology and business logic of your application.

What we examine

• Authentication, session management and account recovery
• Authorisation and access control between users, roles and tenants
• Input handling: injection, file handling, deserialisation
• Business-logic flaws specific to your application
• API design, rate limiting and abuse resistance
• Transport security, headers and platform configuration

What you receive

• A written report with every finding rated by severity and likelihood
• Reproduction steps for each finding so your team can verify it
• A specific remediation for each finding, not a generic recommendation
• Immediate notice of any critical finding during the engagement
• A walkthrough of the report with your engineers
• A re-test of fixed findings, where agreed in the scope

A review of the source code of an application and of the path by which that code, and the pages it produces, reach your users. Many serious weaknesses are invisible from the outside and only found by reading the code; and a correct application can still be compromised if its build, dependencies or delivery are not.

Code review is targeted rather than exhaustive: we agree with you which components matter most, typically those handling authentication, payments, personal data or privileged operations, and read those closely.

What we examine

• Security-relevant application code, chosen with you
• Use of cryptography, secrets and credentials
• Third-party dependencies and how they are pinned and updated
• Build and deployment pipelines, and who can change them
• Hosting, content delivery and the integrity of what users receive
• Logging, monitoring and the ability to detect tampering

What you receive

• A written report of findings with file and line references
• Recommended code changes, described concretely
• An assessment of your dependency and delivery risk
• Prioritised recommendations for pipeline and hosting hardening
• A walkthrough with the engineers who own the code

Design-stage advice for a new system or a significant change to an existing one. The aim is to make security decisions when they are cheap, before anything is built, rather than to find problems afterwards.

This is collaborative work with your technical lead: a threat model of the proposed system, a review of the design against it, and clear recommendations on the choices that matter most. It is often the right first engagement for a company that has not had outside security input before.

What we examine

• Threat model: what you are protecting, from whom, and what an attack would cost you
• Trust boundaries, authentication and authorisation design
• Data flows, storage and handling of personal and sensitive data
• Choice of platforms, frameworks and third-party services
• Operational design: secrets, access, deployment, incident response

What you receive

• A written threat model for the system
• A design review with specific recommendations, ranked by importance
• Working sessions with your technical lead during the design
• Where useful, a follow-up assessment once the system is built

An independent review of a company's software, security and engineering practice, carried out for a party outside that company: an investor considering a funding round, an acquirer, or a business about to depend on the company as a supplier or partner.

The question is not only whether the software works today, but whether it is built, secured and maintained in a way that will hold up. We review the technology with the target's cooperation, under confidentiality, and report to the client in terms a non-technical decision-maker can use, with the technical detail behind it.

What we examine

• Architecture, code quality and technical debt
• Security posture and handling of customer data
• Infrastructure, operations and resilience
• Third-party dependencies, licensing and intellectual property
• Engineering process: testing, release, incident handling
• Whether the technology can support the company's plans

What you receive

• A written report with a plain-language summary for decision-makers
• A technical appendix with the evidence behind each conclusion
• A ranked list of risks, with the cost and effort of addressing each
• Questions and conditions to put to the target company
• A call to discuss the findings before you decide