We're battle-hardened cyber-security professionals who care about the details.
Our ethos:
"More human interaction occurs in the digital realm, than in the physical realm."
We have moved beyond cyber-security being "the protection of computers and networks". It's now about the serious responsibility to protect our DIGITAL SAFETY.
Consulting CISO
CISO-aaS | Board Advisory | Security Maturity | Compliance Mapping
CISO-as-a-Service
Many organisations struggle to hire, train and retain an experienced CISO, or are not of the size to need one full time.
We therefore provide a CISO-as-a-Service model, where you call upon the CISO services you need, as required.
Our team has many (way too many!) years of experience in:
Contact us more details...
We therefore provide a CISO-as-a-Service model, where you call upon the CISO services you need, as required.
Our team has many (way too many!) years of experience in:
- Governance, Risk and Compliance
- IR (Incident Response)
- DR (Disaster Recovery)
- BCP (Business Continuity Planning)
- Enterprise Security Architect
- Penetration Testing and Vulnerability Assessment
- Secure SDLC
Contact us more details...
Board and Exec Advisory
Many organisations have "cyber" as one of their top risks, however Boards and Exec teams are often very under-informed on how to consider, interprate and therefore manage cyber-risks.
If your board or exec team treats "cyber" as simply a technical issue then you need to engage us now!
Contact us more details...
If your board or exec team treats "cyber" as simply a technical issue then you need to engage us now!
- Put cyber-risks in true business terms
- Bride the tech-to-exec gap
Contact us more details...
Cyber Security Maturity
This is a detailed assessment, performed over time, with interactions with all key business units.
We have reusable metrics and tools to help us assess where you are in your cyber-security maturity journey.
We then work with you to assess where you should be on the maturity scale, based on your strategic business plan over the next 5 years, including product and service development, global target markets and target industries.
We then help with a cyber-security strategy to help move you from where you are today, to your future goal.
Cyber-Security Maturity follows the classic CMMI maturity levels, used in IT for many years:
However, you can certainly outsource services, and buy-in products and experts who operate at a higher maturity level.
(See Cybersecurity Capability Maturity Model (C2M2) for more details...)
Contact us more details...
We have reusable metrics and tools to help us assess where you are in your cyber-security maturity journey.
We then work with you to assess where you should be on the maturity scale, based on your strategic business plan over the next 5 years, including product and service development, global target markets and target industries.
We then help with a cyber-security strategy to help move you from where you are today, to your future goal.
Cyber-Security Maturity follows the classic CMMI maturity levels, used in IT for many years:
- Level 1 - "CHAMPIONS": These are the champions inside your org, trying to do there best to secure you.
- Level 2 - "PROJECTS": This is when you now have security projects, to improve your security posture.
- Level 3 - "PROCESSES": You've matured into having repeatable processes. This is where your compliance journey can begin.
- Level 4 - "AUTOMATION": You now automate and have tools for the most common processes, and the most critical.
- Level 5 - "CONTINUOUS IMPROVEMENT": By measuring your repeatable, and automated, processes you continuously improve efficiency and effectiveness.
However, you can certainly outsource services, and buy-in products and experts who operate at a higher maturity level.
(See Cybersecurity Capability Maturity Model (C2M2) for more details...)
Contact us more details...
Compliance Mapping
We have reusable metrics and tools to help us assess where you are in your compliance journey.
We work with you to assess the compliance frameworks relevant now and into the future based on your strategic business plan over the next 5 years, including product and service development, global target markets and target industries.
We then help with a cyber-security strategy to help move you from where you are today, to your future goal.
Compliances include, but are not limited to:
In our experience large customers and government agencies around the world have their own set of cyber-security risk questions, as do insurers. As you scale then the number of security questionnaires you're needed to complete can escalate... A re-usable and efficient process is critical.
Contact us more details...
We work with you to assess the compliance frameworks relevant now and into the future based on your strategic business plan over the next 5 years, including product and service development, global target markets and target industries.
We then help with a cyber-security strategy to help move you from where you are today, to your future goal.
Compliances include, but are not limited to:
- Common Security Frameworks and Standards: NIST, SOC2, ISO27001/ISO27002
- Critical Infrastructure: NERC-CIP, SCADA
- Medical: HIPAA
- Credit Cards: PCI
- Regional: GDPR, NZISM, AUISM
- Etc...
In our experience large customers and government agencies around the world have their own set of cyber-security risk questions, as do insurers. As you scale then the number of security questionnaires you're needed to complete can escalate... A re-usable and efficient process is critical.
Contact us more details...
Risk Exposure Services
Breach Impact | Cyber Risk | Vulnerability Exposure | Incident Response
Breach Impact Assessment
This is a detailed assessment, performed over time, with interactions with all key business units.
We have reusable metrics and tools to help us assess the costs and impacts of a serious breach in terms of:
See our Cyber-Insurance Services.
Contact us more details...
We have reusable metrics and tools to help us assess the costs and impacts of a serious breach in terms of:
- The actual costs of downtime
- Customer loss (based on industry stats)
- Impact to growth plans and customer acquisition (based in industry stats)
- Fines (based on industry, geography and impacted customers)
- Professional services (cyber-security, legal, PR, HR)
- System patches and upgrades to defences (because if you don’t the damages will be much more impactful when it happens again).
See our Cyber-Insurance Services.
Contact us more details...
Cyber Risk Assessment
This is a detailed assessment, performed over time, with interactions with all key business units.
We have reusable metrics and tools to help us assess the costs and impacts of a serious breach in terms of:
Contact us more details...
We have reusable metrics and tools to help us assess the costs and impacts of a serious breach in terms of:
- The actual costs of downtime
- Customer loss (based on industry stats)
- Impact to growth plans and customer acquisition (based in industry stats)
- Fines (based on industry, geography and impacted customers)
- Professional services (cyber-security, legal, PR, HR)
- System patches and upgrades to defences (because if you don’t the damages will be much more impactful when it happens again).
Contact us more details...
Vulnerability Exposure Assessment
This is a critical service, to assess where your business and technology stack is vulnerable to attack.
We provide a wide range of services including:
Contact us more details...
We provide a wide range of services including:
- Web and API penetration testing.
- Internet facing perimeter scanning.
- Custom application pen-testing.
- Code reviews.
- Red-teaming (attacking the tech and humans).
- Stress testing / DDoS testing.
Contact us more details...
Incident Response Planning
This is a detailed assessment, performed over time, with interactions with all key business units.
We have reusable metrics and tools to help us work with you in planning your cyber-incident response plan (IRP):
Any IRP will include:
Of course an IRP is useless unless practised. We therefore work with you to implement regular fire-drill exercises, across the whole org and inside specific business units, to run through incidents.
Contact us more details...
We have reusable metrics and tools to help us work with you in planning your cyber-incident response plan (IRP):
Any IRP will include:
- The composition of your Incident Response Team.
- Exec visibility, reporting, decision making, pre-authorisation of actions and escalation.
- Legal contacts and considerations.
- Insurance actions and considerations.
- PR and pre-planned comms.
- HR and staff implications.
- Tech team, both in-house, and external expert support.
- Geographical and time-of-day considerations.
- 3rd party vendor SLAs, support and response.
Of course an IRP is useless unless practised. We therefore work with you to implement regular fire-drill exercises, across the whole org and inside specific business units, to run through incidents.
Contact us more details...
Cyber-Physical Testing Lab
The line between software and hardware has blurred. Any autonomous vehicle or drone is now as much a complex software system as it is hardware.
We find in modern autonomous SW/HW systems that the customer writes no more than 10% of their own code. 90% will come from the code included in the componentry they use...
Our team has years of experience of testing for some of the world's leading manufacturers.
Services include (but are not limited to):
We find in modern autonomous SW/HW systems that the customer writes no more than 10% of their own code. 90% will come from the code included in the componentry they use...
Our team has years of experience of testing for some of the world's leading manufacturers.
Services include (but are not limited to):
- Software component testing.
- Break testing and fuzzing.
- Authentication and authorisation bypass.
- Custom software installation and system abuse.
- Logging and audit review, for visibility and traceability.
- Full system threat modelling.
- 3rd Party vendor and supplier assessment.
- SBOM (Software Bill of Materials) assessments.
Autonomous Vehicles
Autonomous Mining
Agri-Drones
Delivery Drones
Aviation Drones
Research Articles and Whitepapers
April 2023
Digital Safety
"More human interaction happens in the digital realm than the physical. Software drives our physical world. Are we taking digital safety seriously enough?"Read more...