Security assessment

Where you stand, what to fix first, and what can wait

An outside review of the areas you choose (cloud, network, code delivery, laptops, operations, vendors) at the depth you choose, with risk-rated findings and a roadmap that puts each fix in order: now, this quarter, this year.

Book a consultation How the work runs

Cloud
Code delivery
Operations

Five reasons someone wants an outside view

An investor's due diligence is coming

The fund has sent a security questionnaire or will bring its own adviser, and you want to know the answers before they do.

You are about to buy a company

Before signing, you want to know what its security will cost you to bring up to standard.

An enterprise customer sent its security review

The deal is waiting on a questionnaire about cloud, access and incident handling, and some answers would be guesses today.

ISO 27001 or SOC 2 is on the plan

Before committing to a programme, you want to know how far you are from it and which gaps to close first.

Nobody can say what is riskiest

Cloud, network, code and laptops grew separately, each owner thinks their part is fine, and nobody has looked across all of them.

Book a consultationSound like you? Start with a short call.

From what people tell us to what the systems show

The depth is your choice, and it sets the price and the length. A Snapshot is built from interviews. From Standard upward we also check the systems, because the gap between what people describe and what is configured is usually where the risk is.

Interviews (Snapshot)Hands-on checks (Standard and Extended)

The question

What do the owners say is in place?

What is actually configured?

The evidence

Conversations with the people who run each area, policies, diagrams

Access rights, exposed services, cloud settings, laptop configuration

A typical finding

"Two-factor login is on for everyone"

It is on for staff, and off for three administrator accounts

Enough when

You need a quick, broad picture before a meeting or a decision

Someone outside will check, or you are about to spend money on the result

Every finding comes back with a way to close it: what your team can fix itself, and what we can take on.

An assessment, a penetration test, or a readiness programme

Area	Posture assessment	Penetration test	ISO 27001 / SOC 2 readiness
The question	Where are we weakest, across several areas?	Can someone break into this application or network?	What stands between us and the certificate or the attestation report?
Breadth	The areas you choose, at the depth you choose	One target, in depth	Everything the standard covers
Ends with	Risk-rated findings and an ordered roadmap	Exploited findings with proof, and a retest	A gap list against the standard and a programme to close it
A good first step when	You need the whole picture, or someone outside is about to look	A customer or investor asks for a penetration test report by name	The certificate or the report is the goal

If the request names a penetration test report, the assessment does not replace it. Start with the test.

From kickoff to readout in one working week for a Snapshot

Kickoff
Areas and depth agreed, the owner of each area named for interviews, and access arranged if hands-on checks are included.
Discovery
Interviews with the owners and, from Standard upward, checks of configuration, access and exposed services.
Analysis
Findings rated by how likely they are and what they would cost the business, and grouped where one cause produces several.
Report and readout
Findings, roadmap and a short summary presented to leadership, with a way to close each finding.

A quick picture, a closer look, or the full depth

Snapshot

Suits: A broad picture before a meeting, a call with an investor, or a decision
Depth: Interviews with the owners of each area
Typical length: About a week
Ends with: Findings and a roadmap, read out to leadership

Standard

Suits: A company that wants the picture checked before planning the year
Depth: Interviews plus hands-on checks
Typical length: About three weeks
Ends with: Findings and a roadmap, read out to leadership

Extended

Suits: An acquisition, an audit or a deal with a hard date, or several environments
Depth: Hands-on checks across every area in scope
Typical length: About six weeks
Ends with: The same, plus a session per area with its technical owner

The price is fixed once the areas and depth are agreed.

If you had an assessment recently and the list is not moving, the gap is ownership rather than knowledge, and that is what a managed programme such as DevShield is for.

What an outside view changed before a deadline

ResultEvery critical finding closed before the investor's due diligence call.A fintech startup, three weeks before a funding roundRead the engagement

A fintech startup of 25 people was three weeks from its next round. The lead investor had sent a security questionnaire, and the CTO knew the honest answer to several questions was "we are not sure". The team had grown fast, and nobody had looked at security as a whole.

We agreed to cover cloud, code delivery and operations, and worked with read-only access to the cloud account and the repositories. We found API keys committed to a repository, a production database reachable from the internet, two engineers without two-factor login on the cloud console, and shared admin accounts with no record of who did what.

The team closed every critical finding within two weeks, before the due diligence call, and shared the report and roadmap with the investor.

Name the areas, and the date someone outside will look

A short call about what triggered the question (an investor, an acquisition, a customer review, a certification plan), which areas worry you most, and whether there is a date: a funding round, a signing, a contract, an audit.

Book a consultation

Did not find the service you need? Contact us.