Assessments and advice
Expertise · 6 areas
Breaches rarely come through one big hole. They come through the gaps between edge, APIs, code, monitoring, mobile and ownership. I assess all six, together.
Posture explorer
Pick an area to see the checks I run and the red flags that come up most often.
Area 01
Is hostile traffic stopped before it reaches your applications?
What I check
Red flags I often find
Area 02
Do you know every API you expose, and who can call it?
What I check
Red flags I often find
Area 03
Are you fixing the weaknesses an attacker would actually use?
What I check
Red flags I often find
Area 04
Would your SOC see an application attack while it is happening?
What I check
Red flags I often find
Area 05
Can your customer app defend itself on a device you do not control?
What I check
Red flags I often find
Area 06
Is application security owned, measured and funded?
What I check
Red flags I often find
Deep dives
Try it
Switch defence layers on and off and watch which attacks get through. The gaps between areas are where breaches start.
Malicious input tries to read the customer database.
Bots replay leaked passwords at scale against login and OTP.
A valid user changes an account ID in an API call and reads someone else’s data.
An old, undocumented API version is still live and unprotected.
An unpatched component with a public exploit is attacked.
High-volume requests try to take customer services offline.
A modified copy of your app is distributed to steal credentials.
Malware hooks the app at runtime to intercept transactions.
Legitimate-looking API calls drain data over weeks.
Free 30-minute call
Tell me what you are protecting. You will leave the call knowing whether an assessment makes sense and what it would cover.