Cybersecurity
Security designed in, and tested like an attacker
We design security into systems from the first sketch, then try to break them the way a determined attacker would, before anyone else does.
Talk to us
Our view
Security added at the end is expensive, fragile and easy to work around. Security designed in from the start is mostly invisible. We put threat modeling in the first design session and attack testing in every release, so risk is found while it is still cheap to fix.
Most breaches still start with something ordinary: an unpatched server, a forgotten account, a secret in a repository. We look for the ordinary things first.
And when we find a problem, we help fix it. A report that sits in a drawer makes nobody safer.
By the numbers
Measured, not assumed
- 190
- attack-path tests run by our offensive security team against client systems in the last twelve months.
- 11 days
- median time to close a high-severity finding once a client adopts our remediation plan, down from 47.
- 72 hours
- the longest a critical patch may wait on any system we run, written into every managed services contract.
KIASA security engagements, October 2025 to September 2026.
What we do
Security across the whole life of a system
Threat modeling and secure design
Who would attack this, how, and what it would cost them. Answered in the first design session, revisited at every major change.
Penetration testing and red teaming
Our testers chain small weaknesses into real attack paths, against applications, cloud estates and the people who run them.
Identity and access
Single sign-on, least privilege and joiner, mover and leaver processes that remove access on the day it should go.
Cloud security posture
Continuous checks on every account and workload, with misconfigurations fixed in code rather than by hand.
Security debt assessment
Every unpatched system and known weakness priced by exposure, with a plan that pays the most dangerous debt down first.
Incident readiness and response
Playbooks, rehearsals with your leadership and a team on call when something does go wrong.
Client work
Our work in action
Healthcare
Tessera Health secured one patient record across 38 clinics
Access by role and by clinic, every view logged, and a red-team test before each clinic went live.
Read the case study
Banking and payments
Corrow Savings Bank paid down five years of security debt
Four hundred findings ranked by exposure. The worst forty closed in the first quarter.
Explore banking
Public sector
Riverholt County Council moved 6,000 staff to single sign-on
One identity for every system, and leavers' access removed the day they leave.
Explore public sector
What we think
Thinking on security
Research report
Security debt: the quiet risk on the balance sheet
Unpatched systems behave like unpaid loans. Our method for measuring the exposure and paying it down.
Research report
The maintenance dividend
Patching is maintenance too. How the best performers keep systems current without spending more.
Perspective
Why the second year of a cloud migration matters more than the first
Year two of a cloud migration is when permissions sprawl. What to lock down before it does.
Research report
Platform pulse: what engineering leaders will fund in 2027
Security is the one budget line 320 leaders say they will not cut in 2027.
“They found a route into our records that three previous audits had missed, and then sat with our engineers until it was closed.”
Questions we hear
Before you start
How often should we test?
Before every major release, and at least twice a year for systems that hold customer data. Continuous checks on cloud configuration run every day in between.
Will testing disrupt production?
We agree the rules of engagement first: which systems, which hours, and who to call. Destructive tests run against a copy. Most clients notice nothing until the report arrives.
Do you fix what you find?
If you want us to, yes. Every finding comes with a recommended fix and an estimate, and our engineers can pair with yours to close it.
Can you help with regulators and auditors?
We map our work to the frameworks your regulators use, and prepare the evidence they will ask for. We do not certify you ourselves: that stays independent.
Our leaders
Talk to the people who lead this work
Yusuf Demir
Practice Lead, Cybersecurity
Twenty years in security architecture and incident response. Co-wrote Security debt.
Sinéad Gallagher
Head of Offensive Security
Leads the team that tests client systems the way an attacker would, and explains the results to boards.
Arjun Mehta
Principal Security Architect
Designs identity and access for health, banking and public sector clients. Led the Tessera Health design.
Know where you stand
Ask for a security debt assessment. In three weeks you will know your largest exposures and what it would take to close them.