Security Services
Security work that leaves you measurably harder to break.
We find and fix what an attacker would find first, then help build the habits that keep it fixed — offensive testing, application and cloud security, and AI-specific risk, from people who build and run production software themselves.
What we do on this line.
Built for: Teams shipping software faster than they can secure it, and leaders who need a straight answer about their exposure.
- Stop 1 of 6
Penetration testing
Web, API, mobile, and network testing, with findings you can act on and a retest to confirm the fix.
- Stop 2 of 6
Application security
Secure code review, threat modelling, and guardrails built into your delivery pipeline.
- Stop 3 of 6
Cloud security
Configuration review and hardening across identity, network, and data in your cloud accounts.
- Stop 4 of 6
AI & LLM security Change for AI
Red-teaming for prompt injection, data exfiltration, and unsafe tool use in AI systems.
- Stop 5 of 6
Compliance readiness
Getting controls and evidence in shape for frameworks such as SOC 2 and ISO 27001.
- Stop 6 of 6
Incident readiness
Response plans and tabletop exercises, so the first bad day is not also the first rehearsal.
Three ways to work with us.
Assessment
A fixed-scope test or review with a clear, prioritised report and a retest of what you fix.
Ongoing partner
Continuous testing and security engineering alongside your team, sized to your release pace.
Programme build
Stand up a security programme from first principles: policies, controls, tooling, and ownership.
Connections.
Security Services shares tracks with the other two lines. That is where most of the value is.
AI, built to be attacked
Our AI products are threat-modelled and red-teamed by the same people who test other companies’ systems for a living.
Change for AI ProductsSecurity from people who ship
Our security advice is shaped by running production software ourselves, so it is advice an engineering team can act on.
Change for Vertical SaaS
Questions we hear.
Prioritised findings with evidence, business impact, and specific fixes — written for the engineers who will do the work and summarised for the people who sign off.
We agree scope, timing, and rules of engagement in advance and coordinate with your team throughout.
Yes. Because we also build AI products, we test them the way they are actually built: tools, permissions, retrieval, and all.
Yes. Finding issues is half the job; we work with your engineers on remediation and retest the fixes.
Ready to board?
Tell us where you are and where you need to be. We will map the route with you, and say so plainly if we are not the right line for it.