Cyber security services

Find the weaknesses before someone else does

Security testing, secure code review and compliance support for hospitals, businesses and software teams, with reports that explain every finding and how to fix it.

Services

What we test and support

Vulnerability assessment and penetration testing

Controlled attacks on your systems to find what a real attacker could exploit, followed by a re-test once fixes are in place.

  • Web applications and APIs
  • Mobile applications (Android and iOS)
  • Internal and external networks
  • Cloud accounts and configuration

Secure code and architecture review

Review of source code and system design by engineers who build production software, aimed at the flaws that automated scanners miss.

  • Authentication, sessions and access control
  • Handling of personal and health data
  • Third-party libraries and secrets in code

Compliance and audit readiness

Gap assessments, policies and evidence to help you meet the rules that apply to you, and to prepare for an external audit.

  • Digital Personal Data Protection Act, 2023
  • CERT-In directions on incident reporting and log retention
  • ISO/IEC 27001 readiness
  • Security requirements in NABH digital health standards

Monitoring and incident response

Help to detect, contain and recover from a security incident, and to report it correctly and on time.

  • Log review and alerting set-up
  • Incident handling and recovery support
  • Digital forensic analysis of affected systems

Training and awareness

Practical sessions for staff and management, because most attacks start with a person, not a server.

  • Security awareness for hospital and office staff
  • Simulated phishing exercises
  • Secure development training for software teams

Security for hospitals

Hospitals hold sensitive data and cannot afford downtime. We test the systems that matter most to patient care.

  • Hospital and laboratory software
  • Connected medical devices on the network
  • Backup, recovery and downtime readiness
How an assessment works

Agreed in writing, tested with care

1. Scope and permission

We agree what will be tested, when, and by whom, and you sign written authorisation before any testing starts.

2. Testing

We test within the agreed window, avoiding disruption to live services, and alert you at once to anything critical.

3. Report

Each finding with its risk, the evidence, and clear steps to fix it, plus a summary for management.

4. Re-test

Once fixes are made we test again and confirm in writing which issues are closed.

Your data stays confidential. We sign a non-disclosure agreement, keep test evidence only as long as agreed, and delete it afterwards.

Our own tools

We build the tools we test with

Alongside standard industry tools, we use security software we have written ourselves, so we know exactly what each check looks for.

Anchorroot

Our open-source engine for auditing a computer's firmware and UEFI settings, TPM, hidden persistence, trusted certificates and network telemetry. View on GitHub

Windows hardening checker

Checks Windows machines against a hardening baseline before deployment or during a periodic audit, and reports what needs fixing.

When an incident has already happened, our digital forensics service takes over: preserving evidence and finding out what the attacker did.

Get a quote for your systems

Tell us what you would like tested: the application, network or cloud account, its size and any deadline you are working to.