Services
Define the controls. Build them in. Prove they hold.
Each layer can be engaged on its own. Together they close the loop: governance defines what should happen, engineering makes it happen, operations proves it is happening.
Governance, risk and compliance
Clear controls, mapped to what you are asked to prove.
Programmes for the frameworks your customers and regulators ask for, such as SOC 2, ISO 27001 or NIST CSF. The evidence comes from the controls themselves, so audit season stops being a spreadsheet hunt.
- Risk assessment and a risk register you keep up to date
- Policies written for the way your team actually works
- Control mapping, one control to every framework it satisfies
- Answers for enterprise security questionnaires, each backed by a working control
- Evidence collection and auditor liaison
- YOU HOLD
- Risk register, policies your team can follow, a control map per framework, evidence from live systems
- STARTING POINT
- Audit readiness programme · typically 8 to 12 weeks
Security engineering
Technical controls, built into the systems you run.
Cloud security, identity and access, logging and automation, arranged so that protection never rests on a single control. Built with your tools, or ones we recommend.
- Cloud account structure measured against a written baseline
- Identity and access: IAM, SSO and privileged access review
- Logging and telemetry coverage, with the gaps listed
- Guardrails as infrastructure code, merged into your repositories
- Security automation and drift alerts
- YOU HOLD
- A baseline report per account, guardrails merged as code, a logging coverage map, runbooks for your engineers
- STARTING POINT
- Cloud and identity baseline · typically 4 to 6 weeks
Security operations
Detection and response that shows the controls hold.
Agents investigate. People decide. AI agents gather context, correlate signals and write the first summary. A person approves every containment action.
- Telemetry review against your highest risks
- Detection engineering, with a test case for every detection
- Response playbooks your team can follow
- Agent-assisted triage with a written investigation record
- Handover, shared running, or operating alongside you in stated hours
- YOU HOLD
- Detections with test cases, response playbooks, investigation records, a monthly evidence pack
- STARTING POINT
- Detection and response build · typically 6 to 10 weeks
AI security and governance
Guardrails and evaluation for the models and agents you build, so they act within the limits you set. A growing part of our work.
If you are building on models or agents, raise it on the scoping call. It fits into the same three layers: the policy, the guardrails, and the monitoring that shows they hold.
Not sure which layer you need?
Start from what you need to do next: pass an audit, clear a customer's security review, harden your cloud or detect threats. The scoping call works out which layers that takes, and you leave with a written scope.