Independent, assessment-first application security consulting for banks and enterprises. Fixed scope, fixed fee, vendor-neutral.
01 / How I work
I am a consultant, not a reseller. Nothing gets deployed by default: we start by measuring what you have, then decide together what is worth doing and who should do it.
I audit your applications and the security capabilities you already have: edge, APIs, code, monitoring, mobile and governance. Evidence, not questionnaires.
You get a prioritised plan: what to fix first, what it costs, what risk it removes, and what can wait.
If you want help delivering, I scope it case by case: the expertise and manpower it needs, the timeline, and who is best placed to do it — your team, a partner or Innov8’s AppSec unit.
02 / Engagements
Pick the format that matches the decision you face. Not sure which? The first call is free and that is exactly what it is for.
| Engagement | Scope | You get | Duration | Fee | Enquire |
|---|---|---|---|---|---|
| AppSec maturity assessment | Whole organisation, all six areas, OWASP SAMM v2 based. | Scored baseline, gap analysis, 12–24 month roadmap, board summary | 2–3 weeks | Fixed fee | Enquire |
| Application architecture review | One critical application or platform, edge to code. | Threat model, control coverage map, prioritised fixes | 1–3 weeks | Fixed fee | Enquire |
| WAAP & API protection assessment | Web and API estate, current WAF/WAAP and bot controls. | Coverage gaps, bypass paths, migration or tuning plan | 2–4 weeks | Fixed fee | Enquire |
| Mobile app security assessment | Customer-facing iOS and Android apps. | Mobile threat model, protection policy, MASVS test plan | 1–2 weeks | Fixed fee | Enquire |
| Exposure management (CTEM) assessment | Scanning, testing and remediation process. | Prioritisation model, validation approach, owner playbook, metrics | 2–4 weeks | Fixed fee | Enquire |
| Executive briefing or team workshop | Board, CISO or engineering audience. | Plain-language risk briefing or hands-on workshop | ½–1 day | Fixed fee | Enquire |
| Fractional AppSec advisor | Ongoing senior guidance after an assessment. | Roadmap governance, vendor and design reviews, escalation support | Monthly | Retainer | Enquire |
03 / Deliverables
Every gap with evidence, severity and the business impact, in language both engineers and executives can act on.
A 0–3 score for each of the six areas, so progress is measurable at the next assessment.
30, 90 and 365-day actions with effort and cost ranges, sequenced by risk removed.
Two pages for the board or risk committee: where you stand, what it costs to fix, what happens if you do not.
04 / What I assess
Every assessment covers the same six areas, so your results are comparable year on year and across business units.
Score yourself on all six nowIs hostile traffic stopped before it reaches your applications?
You getCoverage map and a safe path from monitoring to blocking.
Do you know every API you expose, and who can call it?
You getComplete API inventory with the risky endpoints ranked.
Are you fixing the weaknesses an attacker would actually use?
You getA prioritisation model your teams can work from every week.
Would your SOC see an application attack while it is happening?
You getTelemetry gaps closed and detections tied to real attack paths.
Can your customer app defend itself on a device you do not control?
You getMobile threat model and a protection policy that respects UX.
Is application security owned, measured and funded?
You getA scored baseline and a 12–24 month roadmap the board can fund.
On independence
I also head Innov8’s Application Security BU. So the rule is simple: the assessment comes first, it is vendor-neutral, and you are free to take the plan to any delivery partner.
05 / FAQ
Yes. Findings and recommendations start from your risks and requirements, not from a product list. You are free to take the plan to any delivery partner. Innov8’s Application Security BU, which I head, is one option and is always disclosed.
Assessments and reviews are fixed-fee, agreed before work starts and based on scope: number of applications, teams and environments. Ongoing advice is a monthly retainer. The first call is free and decides whether an assessment is the right step.
Between one and four weeks depending on scope. A single application architecture review can take a week; an organisation-wide OWASP SAMM maturity assessment usually takes two to three weeks.
A sponsor, a list of in-scope applications and environments, read-only access to relevant consoles or exports (WAF, scanners, SIEM), and a few hours with the people who own them. Everything is covered by an NDA before work begins.
06 / Start
Tell me what you are protecting and the decision you face. I will tell you honestly whether an assessment is the right step.