Five engagements,
one consultant.

Problem

You have a web application, an internal network, a cloud tenancy, or a mobile app, and you need an honest view of what an attacker could do to it — a technical report you can hand to the team who will fix it.

Engagement

Scope is defined in writing against the specific asset. Most pentests run one to three weeks of active testing plus a week of reporting. Critical findings are surfaced the day they are found so they can be fixed in flight.

Deliverables

• Executive summary (one page)
• Technical findings report with reproducer steps
• Remediation guidance prioritised by exploitability, not CVSS alone
• Retest of fixed issues within 60 days, included

Problem

You have mature defences and want to know how they hold up against an adversary already inside your perimeter. Assumed breach, objective-driven, measured against both your preventive and detective controls.

Engagement

Starts with an intent-setting session: who are we emulating, what does success look like, and what happens if the blue team detects us. A four-to-eight-week operation from initial foothold to documented impact, paced so your SOC learns during the activity, not only from the report.

Deliverables

• Pre-engagement scoping document and rules of engagement
• Weekly written status during active phases
• Full kill-chain narrative with timestamped artefacts
• Sigma / KQL / Splunk detection rules for each technique used
• Joint debrief with the blue team

Problem

You are about to make a large design decision — a new cloud region, an identity consolidation, a zero-trust rollout — and want a second pair of eyes before the money is committed. Or you inherited an environment and need to know where it is weak.

Engagement

Document review plus two to four working sessions with the engineers responsible. I review what you actually have, not a reference architecture. The deliverable is a short, reasoned report: what is solid, what is brittle, what to change, in what order.

Deliverables

• Written architecture review (20–40 pages)
• Prioritised remediation backlog
• Target-state diagram (if useful; not by default)
• One board-level summary

Problem

You are standing up an in-house security operations capability, or rethinking one that has grown unruly. You want a design that holds for the next three years, not the next quarter's tool renewal.

Engagement

Advisory grounded in having designed and run a SOC platform end to end — a 700+ rule, ATT&CK-aligned detection stack with automated triage. I work with your team on detection coverage, tool rationalisation, staffing, and on-call structure. I do not resell products or take referral fees.

Deliverables

• Target operating model document
• Detection coverage map against MITRE ATT&CK
• Tool rationalisation recommendation with vendor-neutral reasoning
• Staffing and on-call proposal

Problem

You want a named responder on call, familiar with your environment, who is useful within the first thirty minutes of an incident — not spending the first days arranging access.

Engagement

A monthly retainer covering onboarding (environment access, runbook review, an annual tabletop), guaranteed response-time SLAs, and a pre-agreed rate for incident work. Retainer fees are credited against incident work billed in the same year.

Deliverables

• Retainer agreement with named SLAs
• Access and tooling validated during onboarding
• Annual tabletop exercise
• During an incident: coordination, containment guidance, written findings