Security
We attack it before anyone else can.
Every release is attacked and fixed in-house before it goes live, and nothing graded Critical or High ever ships.
The colour wheel
Every colour of the security wheel.
Seven teams keep software safe. We cover all of them, on everything we build.
Red Attackers
Ethical attackers who break in to find weaknesses before a real attacker does.
Our red team attacks every release in-house, the way a real attacker would.
Learn more: OffSec: red team exercises (opens in a new tab)OWASP Top 10 (opens in a new tab)
Blue Defenders
Defenders who detect, respond to and protect against attacks.
Our blue team fixes every finding and hardens every release. On a care plan, it keeps your system patched and monitored.
Learn more: OffSec: red team vs blue team (opens in a new tab)NCSC: incident management (opens in a new tab)
Yellow Builders
Builders who design and code systems with security from the ground up.
We design and build every site and app with security in from the first line of code.
Learn more: NCSC: secure development (opens in a new tab)OWASP ASVS (opens in a new tab)
Purple Red and blue together
Attack and defence working as one team in a continuous feedback loop.
Attack, grade, fix and rerun until clean, on every release.
Learn more: OffSec: red teaming vs pentesting (opens in a new tab)MITRE ATT&CK (opens in a new tab)
Green Blue and yellow together
Builders and defenders working together so security is part of every stage of development.
Secret scans, security checks and automated tests run as part of every release, and every fix gets its own test.
Learn more: OWASP DevSecOps Guideline (opens in a new tab)NCSC: continually test (opens in a new tab)
Orange Red and yellow togetherOngoing
Attacker insight passed to the builders, through training and attacker-informed code review.
What our red team finds feeds straight back into how we build, and we keep our knowledge of new attacks up to date.
Learn more: OWASP Security Culture (opens in a new tab)NCSC: keep knowledge sharp (opens in a new tab)
White Governance
Oversight that sets the scope and rules of every test and keeps security in line with policy and business goals.
We set the scope and rules for every test, grade every finding and sign off each release against our Critical and High rule.
Learn more: NIST Cybersecurity Framework (opens in a new tab)NCSC Cyber Assessment Framework (opens in a new tab)
We only test systems we build or look after for you, and only with your agreement.
Every release
Attack, fix, repeat.
Every release goes through in-house red and blue team testing. Our red team tries to break in the way a real attacker would. Our blue team fixes what they find, adds a test so the same gap can’t reopen, then reruns every check before anything goes live.
- 1Built with security in mind
- 2Red team attacks
- 3Findings graded
- 4Blue team fixes
- 5Every check rerun
- 6Governance and legal check, then release
Repeat until clean
Coverage
What every release covers.
Accounts and access
Who can sign in, and what each person can see and change.
Everything you send us
Every form, message and upload.
Hosting and set-up
How it’s served, configured and kept up to date.
Code and what it’s built on
Our code and every package it relies on.
Checked against the OWASP Top 10, OWASP ASVS and the NCSC’s secure development guidance.
We keep the detail of our test plans private. Each client gets the full scope and a plain-English report for their own project.
Findings
Every finding is graded.
- CriticalNever goes live. Fixed first
- HighNever goes live
- MediumFixed straight away
- LowFixed straight away
Nothing graded Critical or High ever goes live. Anything flagged, at any level, is worked on straight away. With every release you get a plain-English test summary and patch notes on anything that affects you.