Services

Findings, evidence and certification.

Work that produces a defensible answer rather than a codebase. You get the report, the evidence behind it and the remediation plan, whether or not you hire us to do the remediation.

  • PQC readiness
  • Offensive testing
  • GRC
  • Audit support
  • Training

S—01

Post-quantum readiness assessment

Six to eight weeks. The cheapest way to find out how exposed you are.

Before any migration, you need to know where your cryptography lives. Most organisations have never had that inventory built.

Discovery

  • Cryptographic bill of materials
  • Certificate and key inventory
  • Protocol and cipher-suite scanning
  • Third-party and supply-chain dependencies

Risk

  • Exposure ranked by confidentiality lifetime
  • Harvest-now-decrypt-later modelling
  • Regulatory deadline mapping
  • Business impact and prioritisation

Roadmap

  • Costed, sequenced migration plan
  • Crypto-agility target architecture
  • Vendor and product gap analysis
  • Board-level summary and technical annex

Standards

  • NIST FIPS 203 / 204 / 205 alignment
  • Entropy source validation, SP 800-90B
  • Key management policy review
  • Cryptographic governance framework

S—02

Security assessment and testing

Scoped, authorised and evidenced. Findings come with reproduction steps.

Offensive testing against your systems, run under written authorisation with agreed rules of engagement.

Penetration testing

  • External and internal network
  • Web and API application testing
  • Mobile application assessment
  • Cloud configuration review

Code and design

  • Secure source code review
  • Cryptographic implementation review
  • Threat modelling and architecture review
  • Dependency and SBOM analysis

Adversarial

  • Red team engagements
  • Social engineering and phishing simulation
  • Physical and access control testing
  • Purple team exercises with your SOC

Infrastructure

  • Network segmentation review
  • OT and embedded device assessment
  • Configuration and hardening audits
  • Vulnerability management programmes

S—03

Governance, risk and compliance

Audit readiness and certification. We prepare you for the audit; our accredited certification partners carry it out and issue the certificate.

Framework implementation, gap closure and the evidence pack your assessor will ask for, then certification through an accredited partner body.

Quality and operations

  • ISO 9001 quality management
  • ISO 14001 environmental management
  • ISO 45001 occupational health and safety
  • ISO 50001 energy management
  • ISO 55001 asset management

Sector standards

  • ISO 22000 food safety
  • ISO 13485 medical device quality
  • ISO 39001 road traffic safety
  • ISO 21001 educational organisations

Security and resilience

  • ISO/IEC 27001 information security
  • ISO/IEC 42001 AI management
  • ISO 22301 business continuity
  • Source code review

Assurance and regulatory

  • SOC 1 and SOC 2 readiness
  • PCI DSS
  • NIST CSF
  • SAMA Cyber Security Framework

Privacy

  • ISO/IEC 27701 privacy information management
  • GDPR alignment and DPIAs
  • PDPL data protection compliance
  • HIPAA and HITRUST

Supply chain

  • Third-party risk assessment
  • Vendor security questionnaires
  • Contractual security requirements
  • Continuous monitoring programmes

S—04

Advisory and technical due diligence

Short engagements. Written answers to questions that carry real cost.

Independent judgement where the decision matters more than the deliverable.

Strategy

  • Quantum readiness roadmaps
  • Build, buy or wait assessments
  • Vendor and platform selection
  • Security architecture review

Feasibility

  • Is this problem worth quantum attention
  • Classical baseline establishment
  • Proof-of-concept scoping
  • Cost and timeline modelling

Due diligence

  • Technical review for investors
  • Claims verification on quantum products
  • Codebase and architecture assessment
  • Team capability review

Incident

  • Cryptographic incident response
  • Key compromise recovery planning
  • Post-incident review
  • Tabletop exercises

S—05

Training and enablement

Delivered on site or remotely. Built around your codebase, not a generic curriculum.

Your engineers should be able to carry this work after we leave. Training is how that happens.

Quantum

  • Quantum computing foundations for engineers
  • Optimization and QUBO formulation workshops
  • Quantum machine learning practicum
  • Hands-on labs on real backends

Cryptography

  • Post-quantum cryptography for developers
  • Crypto-agility design patterns
  • Key management and PKI operations
  • Migration planning workshops

Security

  • Secure development lifecycle
  • Threat modelling for product teams
  • Security awareness for non-technical staff
  • Incident response drills

Executive

  • Board briefings on quantum risk
  • Regulatory landscape sessions
  • Investment and prioritisation framing
  • Separating the claims from the physics

§ What you receive

Report

Findings, ranked

Every finding carries severity, reproduction steps, business impact and a remediation path. Written so an engineer can act and an executive can decide.

Evidence

The working

Scan output, test artefacts, inventory data and methodology. Your auditor will ask for this, and so will anyone who wants to reproduce our conclusions.

Debrief

A session, not a PDF drop

We walk your team through the findings and answer questions. Re-testing after remediation is included in the original scope.