Services

Four practices that work on their own or together, delivered as fixed-scope projects or ongoing support.

Software security

For teams building applications, services and APIs who need security that fits how they already work.

Secure development lifecycle: Practical processes, gates and training that scale from one team to many.
Threat modeling and architecture reviews: Find design flaws before they ship, for applications, services, APIs and devices.
Security tooling: SAST and SCA selection, CI/CD integration and triage so findings get fixed, not ignored.
SBOM and vulnerability management: Generate, monitor and act on component risk, with a clear disclosure process.
Ongoing security leadership: Guidance and decision support as your security program grows.

Talk about software security

Embedded and firmware security

For device makers who need trust from the first instruction to the last update in the field.

Secure boot and signed firmware updates: MCUboot integration, image signing and rollback protection.
Key management and provisioning: Generate, store and inject keys safely, from development to manufacturing.
Device security architecture: Hardware root of trust, debug lockdown and attack surface review.

Talk about embedded security

Compliance and regulatory readiness

For manufacturers placing connected and wireless products on the EU market, and companies answering security questionnaires from customers.

RED cybersecurity (EN 18031): Applicability analysis, gap assessment and remediation against EN 18031-1, -2 and -3 for internet-connected radio equipment.
EU Cyber Resilience Act readiness: Gap assessments, standards mapping and a backlog your teams can execute.
RED to CRA alignment: Build on your EN 18031 work as the foundation for CRA, so you run one security program instead of two.
Technical documentation: Risk assessments, SBOMs and vulnerability handling records in the form assessors expect.
Security program documentation: Policies, processes and evidence for customer and audit requests.

RED cybersecurity requirements have applied to internet-connected radio equipment since August 2025. CRA vulnerability reporting applies from September 2026, with full requirements from December 2027.

Talk about compliance

AI and agentic workflows

For teams ready to move from AI experiments to workflows that save real hours.

Agentic workflow design: Identify repetitive engineering and compliance tasks and build agents to handle them.
Workflow optimization: Measure and improve the accuracy, cost and speed of the AI workflows you already run.
Secure AI adoption: Governance, threat modeling and risk review for coding assistants, agents and tool integrations.

Talk about AI workflows