Cybersecurity and risk

What it includes

• Security audits and vulnerability assessments of networks, servers, applications and cloud accounts
• Penetration testing with the same tools an attacker would use, and a report written for management as well as for engineers
• Hardening of networks, servers and applications: least privilege, key-based access, banning of repeated attempts, encryption in transit and at rest
• Application security: injection, cross-site scripting, forged requests, brute force, session handling, file upload risks
• Identity and access: multi-factor sign-in, role-based permissions, joiner and leaver procedures
• Data protection and privacy: what is held, where, who can reach it, how long it is kept
• Backup and recovery as a security control, with restores tested rather than assumed
• CCTV, video surveillance and physical access control design and management
• Security policies, incident response plans and staff awareness sessions
• Ongoing review, because a system secure last year is not necessarily secure now

How it is approached

• Risk first: what would hurt most, and what is most likely, decide where effort goes.
• Findings are explained in plain language with a clear fix and a priority, never as a wall of jargon.
• Security that people cannot work with gets worked around, so controls are designed to fit how people actually work.
• Nothing is declared secure on paper. It is tested.

What you get

• A clear picture of where the organisation is exposed and what to do about it
• Systems that resist the attacks that actually happen: password guessing, phishing, leaked links, lost laptops, forged requests
• Evidence for boards, lenders and auditors that security is taken seriously
• Staff who know what to do when something looks wrong