Method
How we work
From finding a security problem to proving what changed.We do not stop at identifying a problem. Every engagement is structured around establishing what is wrong, fixing what you approve, verifying the result, and continuing to check where the service supports it.
Before anything changes
Start with the environment
Every engagement begins by understanding what you run and what you need, before any testing or change.
01
Understand the environment
Which clouds, accounts and systems are involved, and how they are run.
02
Establish scope
What is in and out of the engagement, agreed in writing.
03
Identify the problem
What your customers, auditors or engineers need solved.
04
Prioritise
What needs attention first, and what can wait.
Stage 01
Test
Establish what is actually wrong, and what matters most.
Services · what our people do
- Review your cloud controls from read-only access
- Test applications and APIs where a test is in scope
- Review pipelines and infrastructure code where it matters
- Explain each finding in terms of your business, and rank it
- Cloud Security AssessmentAvailableBook a scoping call
- Penetration Testing (VAPT)LaunchingRegister interest
- DevSecOps & CI/CD SecurityAvailableBook a scoping call
ARIA · what the software does
ARIA evaluates cloud controls resource by resource from read-only access, so findings are consistent and can be checked again later.
ARIALaunchingIn development
Findings are the start of the work, not the deliverable.
Stage 02
Fix
Change what was agreed, safely, with your approval.
Services · what our people do
- Plan each fix with your engineers, with its effect and a rollback path
- Apply remediation and hardening where it is in scope
- Lead complex and sensitive production changes
- Build security into new architecture and platforms
- Remediation & HardeningAvailableBook a scoping call
- Secure Cloud EngineeringAvailableBook a scoping call
- Kubernetes SecurityLaunchingRegister interest
ARIA · what the software does
ARIA applies approved, bounded fixes for supported controls, one resource at a time, and tracks the changes your engineers make. A named person in your organisation authorizes every change.
Supported automated fixes are available by enablement for supported controls, subject to customer authorization.
ARIALaunchingIn development
Not every control has an automated fix. Anything complex or sensitive stays with people.
Stage 03
Verify
A fix is not done because a change was made. It is done when the check passes.
Services · what our people do
- Re-run the check that found the problem, on the same resource
- Retest findings from a penetration test after they are fixed
- Keep the open item open if the re-check fails, and say why
- Remediation & HardeningAvailableBook a scoping call
- Penetration Testing (VAPT)LaunchingRegister interest
ARIA · what the software does
ARIA re-runs the same check, marks a control remediated only when it passes, and saves each step as a signed and linked record.
ARIALaunchingIn development
Verification shows that a specific control passes after a specific change. It does not mean the whole environment is secure.
Stage 04
Keep secure
Keep fixed controls fixed as your environment changes.
Services · what our people do
- Review changes and new risks on a recurring cadence
- Fix drift and verify the fix again
- Stay available for security engineering questions and reviews
- Security RetainerAvailableBook a scoping call
ARIA · what the software does
ARIA re-checks controls on a schedule, flags a control that passed and now fails, and keeps the history of each one.
ARIALaunchingIn development
Re-checks run where the service and your environment support them.
The software
What ARIA does
Cloud control remediation and verification
ARIA handles the repeatable cloud-control work in every stage. Your organisation and our engineers keep every decision.
01
Evaluate
Check each control on each resource from read-only access.
02
Fix
Approved, bounded remediation where the cloud's fix capability supports it.
03
Verify
Re-run the same check; only a passing check counts.
04
Keep secure
Re-check on a schedule and flag drift.
05
Evidence
Signed, linked records and a closure record.
Decisions
What people decide
The software never makes an independent decision about your production systems. People remain responsible for:
- Defining the scope of the work
- Prioritising risk
- Deciding what should change
- Approving authorized fixes: a named person in your organisation
- Accepting risk that will not be fixed now
- Authorizing changes to production
- Final operational decisions about your systems
Clouds
Which services apply on each cloud
A service is shown on a cloud only where it covers that cloud, with its state there.
AWS
- Services
- Available
- ARIA
- Launching
- Cloud Security AssessmentAvailable
- Remediation & HardeningAvailable
- Security RetainerAvailable
- DevSecOps & CI/CD SecurityAvailable
- Certification Technical ReadinessAvailable
- Secure Cloud EngineeringAvailable
- Resilience ReviewAvailable
- Cost & Security ReviewAvailable
- Kubernetes SecurityLaunching
Microsoft Azure
- Services
- Available
- ARIA
- Launching
- Cloud Security AssessmentAvailable
- Remediation & HardeningAvailable
- Security RetainerAvailable
- DevSecOps & CI/CD SecurityAvailable
- Certification Technical ReadinessAvailable
- Secure Cloud EngineeringAvailable
- Resilience ReviewAvailable
- Cost & Security ReviewAvailable
- Kubernetes SecurityLaunching
Google Cloud
- Services
- Launching
- ARIA
- Launching
- Cloud Security AssessmentLaunching
- Remediation & HardeningLaunching
- Security RetainerLaunching
In practice
What an engagement looks like
Each engagement is scoped and priced in writing. Timelines are agreed per engagement.
01
Scoping
A call about your cloud and what you need.
02
Written scope
What is in scope, what you receive, and a fixed-price proposal.
03
Engagement
Work starts once you accept the proposal.
04
Findings and priorities
What fails, why it matters, and what to fix first.
05
Approved remediation
Changes your organisation authorizes, and nothing else.
06
Verification
The same check, run again, and recorded.
07
Ongoing support
A retainer where you want the work to continue.
Start with a scoping call.
Tell us about your cloud and what you need to fix or prove. You receive a written scope before any work starts.