All services
18 services · 6 categories · 6 ways to buy
The list is grouped by what the work protects, because that is usually how the problem arrives — an inbox, a pipeline, a network nobody designed, an office with a front door.
The six engagements further down are ways to buy that work, not a seventh category.
What we protect
The 18 below are capabilities rather than packages — what the work covers, not how it is bought. Each category has a page of its own, and every service is a section on it.
The inbox, and the person reading it.
4 services
Real phishing sent to your own people, so you find out who clicks from us rather than from an incident.
Training that follows a real mistake instead of the calendar, aimed at whoever needs it that month.
Incoming mail read in context and the dangerous messages acted on, without holding up the mail everyone works from.
The programme around the other three: who is vulnerable, what they are taught next, and whether the risk is falling.
What your engineers ship.
3 services
Design and code review that keeps pace with your releases instead of queueing in front of them.
Your pipeline set up so the checks run as part of delivery and your engineers can read the results themselves.
Your scanners connected, what is actually urgent sorted from what is not, and the rules enforced in CI/CD.
The systems the business runs on.
4 services
What you actually have, what is exposed, and what an attacker reaches first — measured, not read off a diagram.
Networks separated so one compromise stays where it started, and kept usable afterwards so nobody reverses it.
The evidence of a break-in you already collect, read around the clock, with a person acting when it matters.
Real attempts against your apps, cloud and network, then a list of what worked, worst first, and a re-test.
Laptops nobody manages.
2 services
Laptops brought under one configuration and kept there, including the personal ones nobody has been managing.
Which device, used by which named person, may reach what — so access can be removed in one action when they leave.
The front door, and the room behind it.
2 services
We go through the front door and the room behind it, the way someone who wanted in would.
Visitor Wi-Fi with recorded consent, a stated purpose and a defined retention period, and no password read aloud in the lobby.
What you have to be able to prove.
3 services
Where you stand today: which gaps matter, which do not, and the order to close them in.
A security lead for a few days a month — the priorities, the answers customers ask for, and the written record.
What each framework asks you to prove, checked against what you already have, and the difference closed.
Core services
Six ways to work with us. Two are a one-off look at where you stand, one is a programme that keeps it moving, three run continuously.
/ 01
one-off engagement
Find out where you actually stand
We look at what you have and tell you which gaps matter and which don’t, then give you a short list in the order things should be fixed.
/ 02
one-off engagement
We try to break in, on purpose
Real attempts against your apps, cloud and network in the way someone hostile would, followed by a list of what actually worked, worst first.
/ 03
programme engagement
Security with an owner every month
Instead of a project that ends, you get a monthly plan, someone whose job it is to close what is on it, and a report you can pass upward.
/ 04
ongoing engagement
Someone is watching, and wakes up when it matters
Most companies already collect the evidence of a break-in without anyone reading it, so we watch it instead and act when something is wrong.
/ 05
ongoing engagement
A security lead without hiring one
You get the person who decides what matters first, answers the questions customers and investors ask, and keeps the written record, for a few days a month rather than a salary.
/ 06
ongoing engagement
The part where somebody clicks the link
Most break-ins start with a person rather than a server, so we find who is vulnerable, train them, and show whether the risk is going down.
How the two lists fit together
Each of the six does its work inside one of the categories above — and five of them appear there as a capability as well. DevShield is the only one that exists purely as a programme.
Where to start
Tell us what’s happening and we’ll say which of it is urgent, which can wait, and what it would take. If the answer is “you’re fine for now”, we’ll say that too.
