Real engagements. Measurable outcomes.

The challenge

A mid-size professional services firm with 320 staff across four UK offices had never undergone formal cyber certification. Their device estate had grown organically — a mix of managed laptops, BYOD mobile devices, and legacy on-premise servers — with no consistent patch management or boundary firewall policy in place. A major public sector client required Cyber Essentials Plus certification as a contractual prerequisite.

Our approach

We conducted a scoping exercise to define the certification boundary, followed by a readiness assessment against all five Cyber Essentials technical controls. We identified and remediated gaps across patch management, access control, and malware protection before submitting for Basic certification. We then conducted the Plus verification — including authenticated vulnerability scanning and hands-on technical testing of sampled devices — to achieve the higher tier.

The challenge

A large NHS-affiliated hospital trust was preparing for a CQC inspection and needed independent validation of their network security posture. Their estate included significant legacy infrastructure running unsupported operating systems.

Our approach

We conducted an authenticated internal infrastructure penetration test across 14 network segments, followed by a gap assessment against NHS DSPT requirements. The legacy estate presented significant challenges — several systems could not be patched without clinical risk.

The challenge

A Series B fintech startup was preparing for SOC 2 Type II certification and needed a thorough web application security assessment of their core platform — a multi-tenant financial data aggregation service handling data for 180,000 end users.

Our approach

We conducted a black-box web application penetration test followed by a grey-box API security assessment. We also reviewed their CI/CD pipeline configuration and implemented automated security tooling as part of a DevSecOps integration sprint.

The challenge

A large state-affiliated energy supplier operating across the Gulf region engaged us following an internal audit that flagged concerns about their SAP landscape. The organisation ran a complex multi-system SAP environment — ECC, Solution Manager, and PI/PO — underpinning procurement, finance, HR, and operational reporting for over 8,000 employees. No dedicated SAP security assessment had ever been conducted.

Our approach

We conducted a targeted SAP penetration test across the production landscape, beginning with unauthenticated reconnaissance of exposed SAP services. We identified and chained a series of misconfigurations — including an unprotected SAP Message Server, default RFC gateway settings, and overprivileged dialog users — to achieve full administrative access. We then demonstrated lateral movement from SAP into connected business systems without requiring any social engineering or phishing.

The challenge

A national police department across a major European jurisdiction had deployed a fleet of hardened public-access terminals and internal Citrix-based workstations intended to provide strictly controlled access to case management and evidence systems. The terminals were considered secure by design — locked-down OS builds, restricted peripherals, and application whitelisting. The department commissioned a breakout assessment to independently validate those assumptions before a wider rollout.

Our approach

We conducted a structured breakout test across both the public kiosk estate and the internal Citrix environment, simulating a malicious user with only the access afforded to a member of the public or a low-privileged internal operator. We systematically probed application layer controls, OS-level restrictions, and the Citrix published desktop configuration for escape paths — without using any exploit code or elevated credentials.

The challenge

A fast-growing FCA-regulated payments firm needed to achieve ISO 27001 certification within 12 months as a contractual requirement from a major banking partner. They had no dedicated security function and no existing ISMS.

Our approach

We provided a fractional vCISO to lead the programme, combining ISMS design, risk assessment, policy development, and staff awareness with hands-on technical controls implementation. We managed the certification audit directly.