Service 01 — London
Cybersecurity
Penetration testing, secure code review and cloud security work for teams that want findings they can actually fix — and engineers who will fix them.
What we do
What’s included.
Web application penetration testing
OWASP-aligned testing of your web app and APIs — manual testing backed by tooling, covering authentication, authorisation, business logic, injection and data exposure. Every finding ships with reproduction steps, impact, and a concrete fix.
Secure code review
A read of the code itself, not just the running application: authentication and session handling, access control, input handling, cryptography, secrets management, and dependency hygiene. Best value on the parts of the codebase that handle money, identity or customer data.
Cloud security posture review
AWS, GCP, Vercel and Cloudflare: IAM and permission sprawl, secrets storage, network exposure, storage bucket access, logging and alerting gaps. You get a prioritised list of misconfigurations and the changes to make.
Security architecture and threat modelling
For new products and major features: we map the trust boundaries, work through what an attacker would try, and design the controls before the code is written. Far cheaper than discovering the same issues in a test six months later.
Compliance readiness engineering
The engineering controls behind Cyber Essentials, SOC 2, ISO 27001 and GDPR — access control, logging, encryption, backup and change management — built and evidenced. We do the engineering; the audit itself is carried out by your assessor.
AI and LLM application security
Testing the failure modes specific to AI features: prompt injection, data leakage through context and logs, over-permissioned tool use in agents, and cost or abuse exposure on model endpoints.
Incident readiness and remediation
Hardening after an incident, or before one: patching what the assessment found, tightening logging so the next event is visible, and documenting who does what when something goes wrong. We fix what we find, because we are engineers.
Packages
Two ways to start.
SaaS Security Audit & Compliance Prep
Fixed-scope engagement, typically 3–5 weeksSeed to Series A tech startups
An end-to-end review of your application, cloud and engineering processes mapped to SOC 2 and ISO 27001 readiness — with the engineering fixes done, not just a findings PDF handed over.
- Application and cloud security review
- Gap analysis against SOC 2 trust criteria and ISO 27001 controls
- Prioritised remediation plan
- Hands-on remediation of critical findings
Penetration Testing & Vulnerability Assessment
Fixed-scope, typically 1–3 weeksSeed to Series A tech startups
Manual, OWASP-aligned testing of your web application and APIs, backed by automated vulnerability assessment, with findings written so an engineer can reproduce and fix them.
- Scoping call and rules of engagement
- Authenticated web application and API testing
- Cloud configuration review
- Report with reproduction steps and severity
How it works
Start to handover.
- 01
Scope
A call to agree what is in scope — applications, environments, accounts — what testing is permitted, and what a good outcome looks like. You get a fixed price before anything starts.
- 02
Test
Manual testing against the agreed scope, supported by tooling. Critical findings are reported to you the day we find them rather than held back for the report.
- 03
Report
A written report: findings ranked by real-world impact, reproduction steps, affected code or configuration, and a specific remediation for each. Plus a plain-language summary for non-technical stakeholders.
- 04
Fix and retest
We implement the fixes with your team or hand them over, then retest to confirm each issue is closed and nothing new was introduced.
Who it’s for
Built for teams like these.
FAQ
Questions.
What is the difference between a vulnerability scan and a penetration test?
A scan is automated: it compares your software against a database of known issues and produces a list, including false positives. A penetration test is a person working through your application the way an attacker would — chaining weaknesses together, abusing business logic, testing whether one user can reach another user's data. Scanners never find the logic flaws, and those are usually the ones that matter. We use scanners as one input, not as the test.
Do you fix the issues you find?
Yes, if you want us to. We are engineers first, so remediation is normal work for us rather than a referral to someone else. Some clients take the report and fix it in-house; we will review the fixes and retest either way.
How long does an application security assessment take?
A focused test of a single application typically takes one to two weeks of testing plus reporting. A larger platform with multiple services, or a combined application and cloud review, runs longer. We scope it precisely on the first call and quote a fixed price, so the duration is agreed before we begin.
Can you help us prepare for SOC 2 or Cyber Essentials?
We build and evidence the technical controls those frameworks expect — access control, logging and monitoring, encryption, backup, secure development and change management — and help you write the supporting documentation. We are not an audit or certification body, so the assessment itself is carried out by your chosen auditor.
Do you work with startups or only larger companies?
Both. Startups usually want a single application test before a funding round or an enterprise customer review; larger teams want recurring testing and architecture work. The scope changes, the approach does not.
Talk to us about cybersecurity.
A senior engineer replies within one business day.