Accounts and access
What we examine
Who can access your systems and data, how privileges are granted, and what happens when people leave.
What you receive
Access changes to prioritise and clearer responsibilities for managing accounts.
Cybersecurity consultancy
Your team moved faster.
Did the checks keep up?
A developer accepts a suggestion because the code runs. Someone shares a client file to get a better AI answer. A project ends, but its cloud access stays open. We review the checks behind those moments and help you decide what needs changing.
For teams using workplace AI, coding assistants and cloud services. Scope and fees agreed before work starts.
What connects the risks?
Your people.
Your systems and data.
Access
Cloud
AI use
People
Data
FindThe exposure
PrioritiseThe actions
FixThe gaps
Three shortcuts. Three security decisions.
The shortcut is usually taken to get the work done. Review the data, the code and the access behind it.
What enters the prompt?
A client file helps produce a better answer. It may also put information into a service your business has not approved.
What reaches production?
The code runs. That still leaves authentication, dependencies and secret handling to check before release.
Who gets access?
A link makes collaboration easier. Check who can open it, what they can do and when that access should end.
The review scope
Check the controls. Get usable answers.
Bring the tool, workflow or customer question that concerns you. We agree what to examine, the access we need and what you will receive. A focused review can be the right starting point.
Area
What we examine
What you receive
Cloud and applications
What we examine
The agreed configuration, data flows, permissions and security decisions behind your technology.
What you receive
Configuration and architecture recommendations, with the risk each change addresses.
AI use and data handling
What we examine
Which AI tools people use, what information they share and how generated output is checked.
What you receive
Approved-use guidance and data handling rules your team can follow.
AI-assisted development
What we examine
How coding assistants access repositories and data, how generated changes are reviewed, and how dependencies, secrets and release approval are checked.
What you receive
Recommended review steps, responsibilities and development controls for the agreed scope. This is security guidance, not a product build.
Risks, policies and ownership
What we examine
Existing controls, likely impact, missing documentation and the actions nobody currently owns.
What you receive
A risk assessment, relevant policies and a prioritised roadmap with owners.
Email handling and awareness
What we examine
How your team verifies sensitive requests, reports suspicious messages and uses awareness training.
What you receive
Verification and reporting procedures, with training recommendations for the decisions people face.
Security operations
What we examine
Who reviews alerts, how concerns are escalated and which response procedures your team follows.
What you receive
Defined responsibilities and practical recommendations for handling security concerns.
Customer and supplier reviews
What we examine
Questionnaire requests, supporting evidence and the accuracy of statements about your security.
What you receive
Evidence-backed answers and a clear list of outstanding requirements.
After the review
More findings won’t fix the gaps.
“Review permissions” leaves someone with another job to work out. A useful finding says which access needs changing, who owns the change and what evidence to keep.
We prioritise the work with your team. Where you need help carrying it out, we agree the support and responsibilities.
Illustrative finding
The contractor’s access never ended.
Remove the project access, check related permissions and update the offboarding checklist. Assign an owner. Keep the access-change record and revised procedure.
Prioritise the findings. Assign the work.
From “are we exposed?” to “here’s the plan”.
01
Agree what needs reviewing.
Start with your systems, concern or customer deadline. Agree the scope, access, deliverables and fees before the work starts.
02
Show the gaps and the consequences.
Review the agreed evidence with your team. Explain what each finding means for your data, operations or customer requirements.
03
Turn findings into work.
Prioritise the actions and assign responsibilities. Agree which changes your team will make and where you want our implementation support.
Before we scope the work.
Need compliance readiness support?Can you help us fix the findings?
Yes. We can scope support with controls, policies, documentation and training. Agree the implementation work and your team’s responsibilities alongside the review.
Do we need a full security review?
No. Start with a specific issue, a customer questionnaire or an AI use policy. We will agree a focused scope if that is the work you need.
Is this penetration testing?
A security review assesses the agreed controls, configuration and evidence. It is not a penetration test. We will make the assessment method and its limits clear before starting.
What if we need compliance support?
We also support SOC 2, HIPAA and ISO 27001 readiness, and Cyber Essentials preparation. We can connect the security work with your compliance requirements and evidence.
Close the gap before it costs you.
Tell us where the working practice and the security rules no longer match. Share the tools involved and any customer deadline. We will agree a review scope, deliverables and fees.
Close the gap before it costs you.
Tell us where the working practice and the security rules no longer match. Share the tools involved and any customer deadline. We will agree a review scope, deliverables and fees.