Cybersecurity & Application Security
Application, API, cloud and AI security review and hardening, with our limits stated plainly.
What this is
We are software and AI engineers who secure what we build and review what others built. That means application, API, cloud configuration and AI-specific security work done to a good standard. It does not mean we are a certified penetration-testing firm or a round-the-clock security operations centre, and we say so rather than letting a capability list imply otherwise.
When teams call us about this
If more than one of these is familiar, there is usually a case worth scoping.
- A customer security questionnaire has arrived and nobody can answer it.
- Dependencies carry known vulnerabilities and nothing scans for them.
- Credentials are in configuration files and shared between environments.
- Cloud permissions were granted broadly during a deadline and never tightened.
- An AI feature reads untrusted content and the risk was never assessed.
What this covers
Each item below is part of this service line. Where an offering needs a specialist partner, it is marked as such rather than implied.
-
Cybersecurity consulting
Architecture and process review with prioritised, practical remediation.
-
Application security
Code and design review against OWASP categories, then fixing what is found.
-
API security
Authentication, authorisation, rate limiting, input validation and exposure review.
-
Cloud security
IAM, network, storage, encryption and logging configuration review and hardening.
-
Vulnerability assessment
Automated and manual assessment of known weaknesses, with remediation.
-
AI and LLM application security
Prompt injection, data leakage, tool scoping and tenant isolation for AI systems.
-
Security hardening
Secrets management, dependency scanning, headers, transport and access tightening.
-
Penetration testing
Formal, credentialed penetration testing is delivered with a specialist partner.
With a specialist partner -
Compliance audit and certification
We produce technical evidence and documentation; audit opinions come from accredited bodies.
With a specialist partner -
24/7 security monitoring and incident response
Continuous managed SOC coverage requires a specialist provider; we scope it with a partner.
With a specialist partner
How we scope this: Formal certified penetration testing, accredited compliance audits and 24/7 managed security operations are specialist services. Where you need them, we scope the work with a qualified specialist partner and remain accountable for the engineering remediation. We do not claim certifications, audit credentials or round-the-clock monitoring we do not hold.
What you receive
Artefacts that end up in your repositories and your cloud account, not locked inside our team.
- Security review with findings ranked by exploitability and business impact
- Threat model covering your actual architecture and trust boundaries
- Remediation work, not just a report handed over
- Dependency and container scanning wired into CI
- Secrets moved into a managed store with rotation
- Identity and access review, reducing permissions to least privilege
- Security headers, transport configuration and input validation hardening
- Documentation and evidence for customer security reviews
Typical engagements
The shapes of work we are asked for most often in this area.
Pre-launch review
Assesses an application before it becomes customer-facing and fixes what matters.
Enterprise security questionnaire
Produces the architecture evidence and controls documentation procurement requires.
Cloud permission tightening
Reduces over-broad IAM grants to least privilege without breaking deployments.
AI system hardening
Addresses prompt injection, data leakage and agent credential scope.
Post-incident remediation
Fixes the root cause and the class of issue, then adds detection.
How we run it
Scoping
What is in scope, what is out, and which items need a specialist partner, agreed in writing.
Threat modelling
Trust boundaries, assets, attack paths and realistic adversaries for your system.
Assessment
Code, configuration, dependency and access review against the threat model.
Reporting
Findings ranked by exploitability and impact, each with a concrete remediation.
Remediation
We fix what we found, in your codebase, with tests covering the fix.
Verification
Re-test, add CI scanning and document the controls for your reviewers.
Products we built and sold
Our own commercial platforms, built with this engineering stack. These are products, not client references.
RideOn
A ride-hailing and fleet management platform, now with agentic dispatch, driver support and demand intelligence.
View product Multivendor marketplaceUniBooker
A configurable multivendor service-booking marketplace with agentic onboarding, matching and support.
View product Classifieds marketplaceClassify
A classifieds marketplace with agentic listing creation, moderation and buyer-seller matching.
View productCybersecurity & Application Security — FAQs
Including the questions where the honest answer is "it depends", and what it depends on.
Do you perform penetration testing?
We perform security review, threat modelling, vulnerability assessment and hardening. Formal, credentialed penetration testing, the kind an auditor or enterprise customer will accept, is delivered with a specialist partner. We will tell you which you actually need.
Can you certify us for ISO 27001 or SOC 2?
No. Certification comes from accredited bodies. We can produce the technical documentation, architecture evidence and controls implementation an assessment requires, which is usually the work that delays these programmes.
Do you offer 24/7 monitoring?
Not as a standalone managed SOC. We implement logging, alerting and detection, and define the incident runbook. Continuous staffed coverage requires a specialist provider, and we scope that with a partner rather than overstating our capability.
Will you fix the problems or just report them?
Fix them. A report alone tends to sit in a backlog. Remediation in your codebase, with tests, is the point of the engagement.
Can you secure our AI features?
Yes, and this is where our engineering background is most directly relevant: prompt injection, context leakage, tool and credential scoping, and tenant isolation in AI systems.
Services that pair with this
Cloud, DevOps & Infrastructure
Infrastructure as code, CI/CD pipelines, containerisation and monitoring you can operate yourself.
Read moreAPI Development & System Integration
Documented APIs and integration layers that keep your systems consistent without manual re-entry.
Read moreCustom Software Development
Applications shaped around how your business actually works, not around a product roadmap.
Read more