Practice 03 / 03

Security

Finding the holes before someone else does.

§ 1

What it covers

Penetration testing of web applications and APIs. Manual testing, with findings ranked by real-world risk and written for the people who will fix them.
Security review of code, architecture, and vendors. Before you ship it, build on it, or sign the contract.
Security leadership, ongoing or interim. Someone accountable for security, without a full-time hire.
Programs and audit readiness. Policies, controls, and preparation for SOC 2 and ISO 27001.
Secure development. Threat modeling, checks in CI, and dependency and secrets hygiene.
Incident readiness. Response plans and tabletop exercises, before they’re needed.

All testing requires written authorization from the owner of the systems involved.

Engagements are ongoing, for a set number of hours each month, or fixed-scope projects with a defined end. See the work we build and run.

Have something in mind?