Assess
Compliance Gap Assessment
NIS2, ISO, TISAX, DORA, SOC 2
Cybersecurity and compliance
Security that survives the audit
We test your systems the way attackers will and document them the way auditors expect. Penetration testing shows what can really be exploited, security code review catches flaws before they ship, and governance, risk and compliance work turns both into evidence for NIS2, DORA, ISO 27001 and the other frameworks you answer to.
Assess
Penetration testing
Certified testers attack your systems the way real attackers would, chaining weaknesses into attack paths that automated scanners miss. You get evidence of what can actually be exploited, mapped to the OWASP Top 10 and ranked by business risk, so your team knows what to fix first. Testing is planned around your operations, and the most aggressive tests can run out of hours.
- Web, mobile and desktop applications, and APIs
- Cloud infrastructure, internal and external networks
- IoT devices and SCADA / OT systems
- Social engineering: phishing, pretexting and baiting
- Web3 and smart contracts
- Critical findings flagged as soon as they are confirmed, and a re-test once they are fixed
Assess · Architect
Security code review
Security engineers read your source code to find vulnerabilities and design flaws before they reach production, when fixing them is fastest and cheapest. Automated static analysis (SAST) and dependency scanning (SCA) give fast coverage; manual review against OWASP guidance finds the business-logic flaws that tools cannot.
- Frontend: input handling, sessions and sensitive data (React, Angular, Vue, TypeScript)
- Backend: business logic, data processing and APIs (.NET, Python, Spring Boot, Ruby)
- Infrastructure as code: Docker, Kubernetes, Helm and Terraform
- Authentication, access control, encryption, secrets, payments and third-party libraries
- Read-only access to a snapshot of your code, under NDA; development carries on as normal
- Fix patterns, code examples and Q&A sessions with your developers
Architect · Manage
Governance, risk and compliance
Governance sets the policies and responsibilities, risk management decides what matters most, and compliance proves it to auditors and regulators. We align your technical controls with the frameworks you answer to before the official audit, and produce the evidence that makes certification straightforward.
- Readiness assessments for ISO 27001, SOC 2, PCI DSS, NIS2, DORA and GDPR
- One assessment, evidence for several frameworks: findings mapped to each one's controls
- Risks scored with CVSS and prioritised by regulation, business impact and effort
- Threat-led penetration testing (TLPT) for DORA
- The documentation auditors expect: scope, method, findings, remediation timelines, re-test proof
- A documented, mature risk programme that can also help lower cyber-insurance premiums
All security services
Penetration testing, code review and GRC sit within a wider catalogue of fifteen services across the three phases. Each is scoped on its own, so an engagement can be a single assessment or a full programme.
Assess
Security Testing
Pentesting and vulnerability scans
Assess
AI Security Assessment
LLM pentest and risk
Assess
Cyber Health Check
Executive-level MRI
Assess
Phishing Simulation
Culture baseline
Assess
Exposure Check
Leak verification
Architect
Pre-Incident Planning
Worst-case prep
Architect · Manage
Incident Response
DFIR and recovery
Manage
Dark Web Monitoring
Breach detection
Architect · Manage
Managed Compliance
Journey to conformity
Architect · Manage
AI Security Governance
Policy and lifecycle
Architect · Manage
Security Awareness Training
Human firewall
Architect · Manage
Secure Cloud Adoption
Cloud infrastructure
Architect · Manage
Enterprise Security
Zero Trust and DevSecOps
Assess · Architect · Manage
Active Defense
Continuous protection
Compliance coverage
Regulations, standards and frameworks we take clients through, from gap assessment to conformity. Findings are mapped to each framework's controls, so one engagement can produce evidence for several.
EU regulations and directives
- NIS2Critical infrastructure
- DORAFinance, incl. TLPT
- GDPRPersonal data
- CRAProducts
- AI ActAI regulation
Global standards
- ISO 27001ISMS
- PCI DSSPayments
- TISAXAutomotive
- ISO 42001AI systems
Frameworks
- SOC 2Trust services
- NIST CSF 2.0Cybersecurity
- SCFStrategic controls
- OWASPSecure development
Questions we get asked
How is a penetration test different from a vulnerability scan?
A scan runs automated tools that list known weaknesses. In a penetration test, skilled testers actively exploit those weaknesses, chain several of them into a real attack path and confirm the actual risk, which is what scanners cannot do.
Will testing disrupt our operations?
Tests are planned to avoid it. The most aggressive testing can run outside business hours, and we coordinate with your team throughout. A code review works on a snapshot of your code, so development carries on as normal.
What happens if you find something critical?
Your designated contact hears about it straight away, and testing pauses if needed, so your team can contain the risk while we carry on with other areas.
How often should we test?
At least once a year, and after significant changes such as major releases or infrastructure updates. Some frameworks, PCI DSS among them, require annual testing. Code review works best as a recurring practice at each major release.
Can one assessment cover several frameworks?
Yes. Findings are mapped to the controls of every framework that applies to you, such as ISO 27001, SOC 2, PCI DSS, NIS2 or GDPR, so a single engagement produces evidence for all of them.
Do you help fix what you find?
Yes. Every finding comes with remediation guidance, and code reviews add fix patterns and Q&A sessions with your developers. Once the fixes are in, a re-test confirms each issue is closed.