Our services
Built for real environments.
Six practice areas covering the full lifecycle — from understanding risk to responding under pressure.
01
Risk Assessment
Know your real exposure — before attackers do.
Most organisations carry risk they can't see. We identify what matters, find what's exposed, and show you the shortest path to reducing risk.
Our assessments cover people, process, and technology — combining automated discovery with expert review to surface the issues that actually matter.
What's included
- Asset and data discovery
- Technical vulnerability assessment
- Threat modelling
- Prioritised remediation roadmap
02
Custom Security Frameworks
Practical protection — scoped to your reality.
Off-the-shelf frameworks rarely fit. We build security programmes aligned to your business objectives, regulatory obligations, and risk appetite.
The result is a programme your team can actually run — without drowning in policy documents that nobody reads.
What's included
- Programme design and governance
- Policy and standards authoring
- Control mapping (ISO 27001, NIST CSF, POPIA)
- Roadmap and KPI definition
03
Incident Response Planning
Prepare once, recover fast.
When something goes wrong, the difference between a bad day and a catastrophic one is preparation. We build incident response playbooks, run tabletop exercises, and stand ready to help when real incidents hit.
Retainer clients get guaranteed response windows and a team that already knows their environment.
What's included
- Playbook development
- Tabletop exercises
- Retainer and on-call response
- Post-incident review
04
Cyber Threat Analysis
Intelligence you can act on.
Raw threat feeds are noise. We translate threat intelligence into specific, prioritised actions relevant to your sector and architecture.
Whether you need a one-off threat brief or ongoing monitoring, we focus on signal over volume.
What's included
- Sector-specific threat briefings
- IoC enrichment and triage
- Attack surface monitoring
- Adversary simulation
05
Security Best Practices
Hardening baselines that actually work.
We help teams implement the boring stuff that prevents most incidents — patching, access control, logging, backups — without the dogma.
Our recommendations are grounded in what works at real organisations, not what sounds good on a slide.
What's included
- Endpoint and cloud hardening
- Identity and access review
- Logging and monitoring design
- Awareness and phishing simulation
06
Compliance & Risk Management
Meet obligations without losing sight of real risk.
POPIA, ISO 27001, PCI DSS — compliance is real work, but it should never become theatre. We help you meet the obligations efficiently while keeping genuine risk reduction in focus.
We also support ongoing risk management — registers, reviews, and board reporting that executives actually use.
What's included
- POPIA readiness and gap assessment
- ISO 27001 implementation support
- Risk register and reporting
- Third-party and vendor risk reviews