Security advice for everything your customers, staff and systems can reach.
Sproble reviews and advises on the edge, API, DNS and access controls that protect your systems, and can help implement them. Recommendations follow your risk and requirements, and any commercial relationships are disclosed in writing.
Every public-facing asset reviewed. One written report.
Services
Advisory services for what the public and your people can reach, with optional implementation.
Edge security architecture review
Vendor-neutral assessment of CDN, WAF, DDoS and DNS design, origin protection, TLS and caching of sensitive content.
Bot and abuse defence
Strategy and policy review for credential stuffing, account takeover, scraping and fraud.
API security advisory
Review of API inventory, authentication, schema validation, protection and rate limiting.
Compliance advisory
Gap assessment and control mapping for PCI DSS 4.0, SOC 2, ISO 27001 and privacy requirements, with audit preparation.
External exposure assessment
Review of internet-facing assets, certificates, subdomains and origin exposure, with verification that edge controls operate as intended.
Secure access and private connectivity
Review and design of workforce, third-party, cloud and workload access, replacing network-wide trust with identity-based, least-privilege controls.
Platform selection and optimisation
Requirements definition, vendor comparison, proof-of-concept criteria, migration planning and review of existing platform value.
Implementation and managed services
Optional hands-on implementation of our recommendations, with test evidence and handover. Engaged only where you ask.
How we work
Four stages, concluding in a written report your teams and auditors can use.
- AssessReview architecture, configuration, traffic and risk with your platform owners.
- DesignDefine target-state controls aligned to your risk appetite and obligations.
- RecommendPrioritised, specific recommendations with rationale and effort estimates.
- ReviewConfirm that the changes your team made, or we made for you, operate as designed.
Written to be acted on
Every finding states the current state, the risk, the recommended change and the supporting standard. Engineers can implement it and auditors can reference it.
R-07 Origin reachable without passing through the edge
Client: Redacted Ltd Scope: www.redacted.example
Priority: High- Current state
- The origin accepts requests from any source address, so edge protections can be bypassed.
- Risk
- WAF and bot controls do not apply to direct requests.
- Recommendation
- Restrict origin access to platform address ranges and require mutual TLS or a signed header.
- Reference
- PCI DSS 4.0 requirement 6.4.2
R-12 Contractor access relies on shared VPN credentials with no expiry
Client: Redacted Ltd Scope: vpn.redacted.example
Priority: High- Current state
- Contractors and vendors connect over a shared VPN profile whose credentials have no expiry date.
- Risk
- Former contractors retain access indefinitely, and shared credentials cannot be attributed to an individual.
- Recommendation
- Move contractors to named, identity-based access with automatic expiry, and review entitlements quarterly to limit standing privilege.
- Reference
- PCI DSS 4.0 requirements 7 and 8
Independence
We disclose in writing any commercial relationship that could influence a recommendation. Our independence policy sets out the rules in full.