Featured
Penetration testing
Black-box, grey-box, internal. Application + infrastructure. Quarterly and on-demand.
Independent · partner-led · twelve years
When the breach matters, you call us.
Penetration testing, incident response, security architecture review. We work with banks, healthcare, defence, and the occasional startup that should know better.
Trusted in regulated sectors
Banking
Healthcare
Defence
Energy
Fintech
01ServicesNDA on first contact
Six ways we break in before they do
Every engagement partner-led. No junior-run projects, no rebadged scanner output.
Incident response
Active-breach triage. Retainer clients get a partner on a call within 60 minutes.
Red team
Multi-week adversarial engagements — physical and social engineering on request.
Architecture review
Threat modelling and design review before launch, not after the incident.
Compliance
SOC 2, ISO 27001, HIPAA, PCI DSS — readiness, audit prep, remediation.
Training
Live secure-engineering training built from our own casework. CPE-eligible.
02The recordTwelve years, zero leaks
- 400++
- Engagements delivered
- 14
- CVEs published in 2024
- 60 min
- IR call-back, retainer clients
- 12
- Senior operators — no juniors
Boutique, on purpose
Them
Big-firm security arm
- Who does the work
Rotating junior bench
- Findings report
Templated scanner export
- IR response time
Next business day
- Research culture
Marketing whitepapers
Us
Us
- Who does the work
Partner-level operators
- Findings report
Written by the tester
- IR response time
60-minute call-back
- Research culture
14 CVEs last year
Selected engagementsFull references under NDA
What we found, anonymised
Clients are never named and findings are never detailed publicly. Sector, scale and outcome are what we can say — the rest is under NDA and stays there.
Payment platform, pre-Series C diligence
Three weeks, grey-boxPen testRetest included2026Ransomware containment, out of hours
Call at 02:14, partner on at 02:51IRUnder privilege2026Red team against a regional bank
Six weeks, physical + socialRed teamPhysical2025Architecture review before a launch
Four weeks, pre-productionDesign review2025
03Proposal within 5 days
Engagement models
Fixed scopes, written proposals, NDA before details. Numbers below are typical entry points.
What security leaders say
04NDA-first, always
Before you engage
How do engagements start?+
NDA first, then a scoping call with a partner. You get a written proposal with fixed pricing within five business days.
We're mid-breach. What do we do?+
Call the hotline. Retainer clients get a partner within 60 minutes; non-retainer triage is subject to bench availability — we will tell you honestly on the call.
Do you replace our compliance auditor?+
No — we prepare you for the audit and remediate findings. Independence matters; we don't audit our own work.
Can findings stay off email?+
Yes. Reports are delivered through an encrypted portal, and we routinely work under counsel privilege on IR matters.
Can you work in cleared environments?+
Clearance status is confirmed per engagement on the scoping call, and cleared-facility work is scoped case by case rather than assumed. Ask early — it changes the timeline more than the price.
Will you retest after fixes?+
One retest round is included in every assessment. Regression findings are documented in the same report chain.
Test it before someone else does.
Scoping calls are free, partner-led, and under NDA from the first minute.
NDA-first · Partner-led · Proposal within 5 days
Engage us
NDA-first. We respond within one business day. Active breach? Skip the form and call the hotline.
- Breach hotline (24/7)
- Email
- PGPKey on request — ask by email