Assessments and advice
Services · 7 engagements
Every engagement has a fixed scope and a fixed fee, and every assessment ends in a prioritised plan. Execution is a separate decision, made case by case.
Which one fits?
Pick the sentence closest to where you are. If none fits, the free call is for exactly that.
I recommend
I score your application security practices against OWASP SAMM v2 using evidence, not opinion, then turn the gaps into a roadmap your board can fund.
I recommend
I take one application or platform and trace every path from the internet to its data, then show which controls hold, which are missing and what to fix first.
I recommend
I review your WAF, WAAP, bot and API controls against your real estate and traffic, then show the gaps, the bypass paths and a safe route to blocking.
I recommend
I model the threats to your iOS and Android apps, review the protection you have or plan, and set a policy that stops attacks without locking out customers.
I recommend
I review how you find, rank, prove and fix exposures, then give you a prioritisation model and an owner playbook your teams can run every week.
I recommend
A plain-language briefing for the board and executives, or a hands-on workshop for engineers, built around your own applications rather than generic slides.
I recommend
After an assessment, I stay on a monthly retainer to keep the roadmap moving, review designs and vendors, and help when something urgent lands.
How I work
I am a consultant, not a reseller. Delivery is never assumed: it is scoped by the expertise, manpower and timeline it needs, then given to whoever is best placed.
I audit your applications and the security you already have, across six areas. Evidence, not questionnaires.
1–4 weeks
A prioritised plan: what to fix first, what it costs, and what risk it removes.
With the assessment
If you want help delivering, I scope it by expertise, manpower and timeline. Your team, a partner or Innov8.
Only where it makes sense
If you choose to execute, who delivers?
All services
Yes. Findings and recommendations start from your risks and requirements, not from a product list. You are free to take the plan to any delivery partner. Innov8’s Application Security BU, which I head, is one option and is always disclosed.
Assessments and reviews are fixed-fee, agreed before work starts and based on scope: number of applications, teams and environments. Ongoing advice is a monthly retainer. The first call is free and decides whether an assessment is the right step.
Between one and four weeks depending on scope. A single application architecture review can take a week; an organisation-wide OWASP SAMM maturity assessment usually takes two to three weeks.
A sponsor, a list of in-scope applications and environments, read-only access to relevant consoles or exports (WAF, scanners, SIEM), and a few hours with the people who own them. Everything is covered by an NDA before work begins.
Free 30-minute call
Tell me what you are protecting. You will leave the call knowing whether an assessment makes sense and what it would cover.