Services

Advisory engagements for the platforms and interfaces your customers, staff and systems can reach - with optional implementation. Each begins with a written scope and ends with a written report.

Edge security architecture review

Vendor-neutral assessment of CDN, WAF, DDoS and DNS design, origin protection, TLS and caching of sensitive content.

Scope: Architecture, configuration and policy documentation agreed in writing.
Deliverable: Findings, prioritised recommendations and a target-state design.

Bot and abuse defence

Strategy and policy review for credential stuffing, account takeover, scraping and fraud.

Scope: Bot management policy, detection and response processes.
Deliverable: Policy assessment and tuning recommendations.

API security advisory

Review of API inventory, authentication, schema validation, protection and rate limiting.

Scope: Public and partner-facing APIs named in the scope.
Deliverable: API risk register and protection strategy.

Compliance advisory

Gap assessment and control mapping for PCI DSS 4.0, SOC 2, ISO 27001 and privacy requirements, with audit preparation. This is guidance on control design and readiness. It is not an audit, certification or legal advice.

Scope: Controls relating to public-facing systems. No implementation work.
Deliverable: Gap report, control mapping and evidence checklist.

External exposure assessment

Review of internet-facing assets, certificates, subdomains and origin exposure, with verification that edge controls operate as intended. Performed only on assets you authorise in writing.

Scope: Agreed assets and methods. No internal network or internal audit work.
Deliverable: Exposure report with prioritised remediation guidance.

Secure access and private connectivity

Review and design of how people, devices, workloads and third parties reach your systems, wherever those systems run. We help replace broad network trust with identity-based, least-privilege access that is simple for users and evidenced for auditors.

Typical coverage:

Remote and hybrid workforce access, including replacing legacy VPNs
Zero trust access policies, SSO, MFA and device posture requirements
Privileged access to servers, databases and admin tools, with session visibility
Contractor, vendor and temporary access with automatic expiry
Multi-cloud, hybrid and multi-site connectivity
Kubernetes, container and service-to-service connectivity
CI/CD pipeline and developer environment access
Edge, IoT and remote equipment management
Secure access to internal tools, SaaS administration and IP-restricted services
AI model, agent and tool access, including isolation and sandboxing
Network segmentation, access logging and audit evidence
Connectivity planning for mergers, acquisitions and new sites

Scope: Access paths, identity and device controls, and network connectivity named in writing. Internal audit and penetration testing are not included.
Deliverable: Access architecture, prioritised recommendations and a least-privilege policy design, with a migration plan that can replace or reduce reliance on existing VPN or network-based access.

Platform selection and optimisation

Requirements definition, vendor comparison, proof-of-concept criteria, migration planning and review of existing platform value.

Scope: Platforms and vendors relevant to your requirements.
Deliverable: Evaluation report and migration plan.

Implementation and managed services

Optional hands-on help putting recommendations into effect - ours, or your existing plans. Engaged only where you ask for it: every advisory engagement stands alone, and our advice is never conditional on buying implementation.

Scope: Edge, API, DNS and access-control changes named in a separate written scope. Your team approves every change; nothing open-ended, nothing undocumented.
Deliverable: Implemented controls with test evidence and handover documentation, so your team - or any provider you choose - can operate them. No lock-in.