Every service is scoped in writing, run within agreed limits, and reported in plain business language alongside technical detail.
Understand where a determined attacker could get in, what they could reach, and what to fix first.
Bring practical visibility to patching, configuration, access, segmentation, and everyday safeguards.
Measure human risk with agreed, proportionate exercises and turn the results into useful staff guidance.
Simulate a compromised employee or endpoint to test segmentation, privilege escalation and lateral movement.
Patching, insecure services, privileged groups, stored credentials and local privilege escalation.
Local admin rights, endpoint protection, BitLocker, script controls and exposed services.
Public IPs, VPN gateways, DNS, TLS, exposed management interfaces and SPF, DKIM and DMARC.
Authentication, sessions, input validation, access control and API exposure, guided by OWASP WSTG.
Authorised staff exercises followed by training and retesting, only when separately agreed.
Excluded unless added in writing: denial-of-service, destructive testing, bulk data extraction, source-code review, and changes to production records.
An optional, practical review of technical safeguards and evidence that can inform your privacy work. This is not legal advice or a POPIA compliance certification.
A tabletop exercise and response-readiness review to help teams clarify decisions, escalation paths, and recovery responsibilities before an incident.
A potential extension for approved cloud environments, with scope and access agreed separately before the work begins.