Practice 01
Offensive & Defensive Security
We emulate the adversaries you actually face, then help your defenders detect, contain, and recover faster, closing the loop between attack and defense.
Cyber Defense
Build and mature the people, processes, and technology that detect and stop attacks: from logging architecture and SIEM engineering to threat hunting and incident response readiness.
Most organizations own capable security tools but lack the telemetry, tuning, and playbooks to make them effective. We assess your security operations against the MITRE ATT&CK framework and your real threat landscape, close visibility gaps, engineer high-fidelity detections, and prepare your team to respond decisively when an incident occurs. Engagements range from a focused SOC maturity assessment to a multi-month build-out of detection and response capability.
What's included
- SOC maturity assessment covering people, process, technology, and metrics
- Log source strategy and centralized logging architecture (identity, endpoint, network, cloud, SaaS)
- SIEM and SOAR engineering on Microsoft Sentinel, Splunk, Google Security Operations, or Elastic
- Detection engineering: use-case design, detection-as-code, tuning to reduce false positives
- MITRE ATT&CK coverage mapping against threat-intelligence-prioritized techniques
- Hypothesis-driven threat hunting across endpoint, identity, and cloud telemetry
- Incident response plan, role-specific playbooks (ransomware, BEC, cloud compromise, insider)
- Executive and technical tabletop exercises
- Vulnerability management program design with risk-based prioritization
Deliverables
- SOC maturity scorecard and 12-month improvement roadmap
- ATT&CK detection coverage heatmap (current vs. target)
- Logging standard with required sources, fields, and retention
- Version-controlled detection rule library with documentation
- Incident response plan and playbooks, aligned to NIST SP 800-61
- Threat hunt reports with findings and new detections
- Tabletop after-action report with improvement actions
Outcome: Measurably shorter time to detect and respond, fewer noisy alerts, and a team that has rehearsed its response before it matters.
MITRE ATT&CKMicrosoft SentinelSplunkGoogle SecOpsNIST SP 800-61
Red Team
Objective-based adversary emulation that tests your organization's ability to prevent, detect, and respond to a determined, stealthy attacker, end to end.
Unlike a penetration test, which aims to find as many vulnerabilities as possible, a red team engagement pursues specific business objectives (access to crown-jewel data, domain dominance, fraudulent payment initiation) the way a real threat actor would. We build scenarios from threat intelligence relevant to your industry, operate covertly against your live defenses, and document precisely where controls held and where they failed. Every engagement runs under formal rules of engagement with a trusted-agent deconfliction process to keep operations safe.
What's included
- Threat-intelligence-led scenario design and agreed objectives ("flags")
- Rules of engagement, legal authorization, and white-cell deconfliction
- External reconnaissance and attack surface mapping
- Initial access via phishing, vishing, exposed services, or credential attacks
- Assumed-breach scenarios starting from a standard user workstation
- Active Directory and Entra ID attack paths, privilege escalation, lateral movement
- Cloud control-plane attacks across Azure, AWS, and GCP
- EDR and SOC evasion testing using custom tooling and tradecraft
- Optional physical intrusion and social engineering components
Deliverables
- Executive summary of business impact and objectives achieved
- Full attack narrative and timeline mapped to MITRE ATT&CK
- Detection-and-response gap analysis (what was seen, missed, or ignored)
- Technical findings with risk ratings and remediation guidance
- Indicators of compromise and artifacts for your blue team
- Executive and technical debrief sessions
- Optional replay as a purple team exercise
Outcome: An honest, evidence-based answer to "could a real attacker achieve this, and would we notice?", plus a prioritized plan to make the answer "no".
Adversary emulationAssumed breachActive DirectoryCloud attack pathsSocial engineering
Purple Team
Collaborative, transparent exercises where our offensive operators and your defenders work side by side to test, measure, and improve detection technique by technique.
Purple teaming converts offensive insight directly into defensive improvement. Together we select ATT&CK techniques used by the threat groups most relevant to you, execute them in your environment, and observe in real time whether your controls prevent, alert, or stay silent. Where gaps appear, we write and tune detections in the session and re-run the technique to prove they work. The result is a validated, continuously improvable detection baseline rather than a point-in-time report.
What's included
- Threat profile selection and technique test plan mapped to ATT&CK
- Controlled execution of techniques using Atomic Red Team, Caldera, and custom tooling
- Real-time observation of EDR, SIEM, and network control responses
- Joint triage: prevented, detected, logged-only, or missed
- In-session detection engineering and tuning
- Retest to validate new and improved detections
- Analyst coaching on investigation and response workflows
- Setup for continuous, automated breach-and-attack simulation
Deliverables
- Technique-level scorecard (prevent / detect / respond)
- Before-and-after ATT&CK coverage heatmaps
- New and tuned detection rules, ready to deploy
- Logging and telemetry gaps with remediation steps
- Repeatable test cases for regression testing
- Prioritized backlog for remaining gaps
Outcome: Proven detection coverage for the techniques that matter most, and a blue team that understands attacker behavior first-hand.
MITRE ATT&CKAtomic Red TeamDetection engineeringBAS
Endpoint Detection & Response
Select, deploy, tune, and operationalize EDR so that every endpoint and server is covered, configured to block, and connected to a response process that works.
EDR is only as effective as its coverage and configuration. We frequently find agents missing from servers, over-broad exclusions that create blind spots, prevention features left in audit mode, and alerts that nobody triages. We help you choose the right platform, roll it out safely across Windows, macOS, and Linux, harden its policies, integrate it with your SIEM and SOAR, and build the response playbooks that turn alerts into containment, whether operated in-house or co-managed.
What's included
- Platform evaluation and selection (Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne, and others)
- Phased deployment planning, pilot groups, and rollback strategy
- Coverage assessment to find unmanaged and unprotected assets
- Policy hardening: prevention modes, attack surface reduction rules, tamper protection
- Exclusion review and clean-up to eliminate blind spots
- Device control, firewall, and application control integration
- SIEM/SOAR integration and automated response (isolation, kill, quarantine)
- Response playbooks and analyst training
- XDR correlation across identity, email, and cloud signals
Deliverables
- Platform comparison and recommendation (for selection engagements)
- Deployment plan and coverage report by OS and business unit
- Hardened policy baseline with documented rationale
- Exclusion register with owners and review dates
- Integration runbooks and automated response workflows
- Detection validation results from controlled attack simulation
Outcome: Near-complete endpoint coverage, prevention features actually turned on, and alerts that lead to fast, consistent containment.
Defender for EndpointCrowdStrike FalconSentinelOneXDRASR rules
Practice 02
Security Testing
Expert-led manual testing, supported by tooling but never replaced by it. Every finding comes with proof, business context, and a clear path to remediation, and we retest to confirm fixes.
Web Application Testing
In-depth security assessment of your web applications and APIs, including authenticated, role-based, and business-logic testing, plus integration of security into the software development lifecycle.
Web application testing focuses on the application itself: how it handles authentication, sessions, authorization, input, data, and business workflows. Using the OWASP Application Security Verification Standard (ASVS) as a baseline, we test every user role, every API, and every workflow for flaws that automated scanners cannot find, such as broken access control, logic abuse, and multi-step attack chains. For teams that ship continuously, we also help embed security into development with threat modeling, secure code review, and pipeline tooling.
What's included
- Authenticated testing across all user roles and tenants
- OWASP Top 10 and ASVS-aligned verification
- REST, GraphQL, and SOAP API testing against the OWASP API Security Top 10
- Access control and IDOR testing, including multi-tenant isolation
- Business logic abuse: pricing, workflow bypass, race conditions
- Authentication, session, OAuth/OIDC, and SAML implementation review
- Secure source code review for high-risk components
- Threat modeling for new features and architectures
- SAST, DAST, and SCA tooling integration in CI/CD pipelines
Deliverables
- Executive summary with overall risk posture
- Detailed findings with CVSS scoring, evidence, and reproduction steps
- Developer-focused remediation guidance and code examples
- ASVS coverage matrix
- Threat model documents (where in scope)
- Retest report confirming remediation
Outcome: Applications and APIs that withstand real-world abuse, and development teams equipped to keep them that way.
OWASP ASVSOWASP API Top 10Secure code reviewThreat modelingDevSecOps
Web Penetration Testing
Adversarial testing of your internet-facing web estate (applications, servers, gateways, and the infrastructure behind them) to demonstrate what an external attacker could actually achieve.
Where web application testing goes deep on a single application, web penetration testing takes the attacker's wide-angle view. We discover your exposed web footprint (including forgotten subdomains, staging sites, and cloud-hosted assets), identify weaknesses across the application, web server, and hosting layers, and chain them together to show real impact: data access, account takeover, or a foothold into internal networks. Testing follows recognized methodologies (OWASP WSTG, PTES) and can be performed black-box, grey-box, or white-box.
What's included
- Attack surface discovery: subdomains, virtual hosts, exposed admin panels
- Web server, framework, and CMS vulnerability identification
- TLS configuration and HTTP security header review
- WAF and CDN bypass testing, including origin server exposure
- Injection, deserialization, SSRF, and file upload exploitation
- Credential attacks against login portals (within agreed limits)
- Cloud storage and metadata service exposure checks
- Exploit chaining to demonstrate end-to-end business impact
- Post-exploitation pivot assessment (where authorized)
Deliverables
- External web attack surface inventory
- Attack narratives showing exploit chains and impact
- Risk-rated findings with evidence and remediation steps
- Executive summary suitable for boards, customers, and auditors
- Letter of attestation for third-party assurance requests
- Remediation verification retest
Outcome: A clear picture of how your web presence could be breached, and evidence to customers and auditors that it has been tested and fixed.
OWASP WSTGPTESBlack / grey / white boxAttack surface management
Wireless Testing
On-site assessment of your Wi-Fi networks to verify that attackers in the parking lot or lobby cannot join, impersonate, or pivot through your wireless infrastructure.
Wireless networks extend your perimeter beyond your walls. We survey the radio environment at your locations, evaluate the configuration and authentication of corporate, guest, and IoT networks, and attempt the attacks a nearby adversary would use: cracking pre-shared keys, standing up rogue access points to harvest credentials, and testing whether guest networks are truly isolated from corporate and cardholder data environments. We also validate that wireless intrusion detection and prevention systems spot what they should.
What's included
- RF survey and identification of authorized, rogue, and neighboring access points
- WPA2/WPA3-Personal and Enterprise configuration review
- 802.1X / EAP assessment, including certificate validation on clients
- Evil-twin and rogue AP attacks to test credential exposure
- Pre-shared key capture and offline strength testing
- Guest and IoT network isolation and segmentation testing
- Captive portal bypass attempts
- WIDS/WIPS detection validation
- PCI DSS rogue wireless detection support (Requirement 11.2)
Deliverables
- Wireless network inventory and coverage observations per site
- Rogue and unauthorized access point report
- Risk-rated findings with configuration-level remediation
- Segmentation test results for guest, IoT, and CDE networks
- Recommended secure wireless reference configuration
Outcome: Confidence that your wireless networks authenticate the right users, isolate the wrong ones, and don't become an easy entry point.
WPA3802.1X / EAPRogue APSegmentationPCI 11.2
Practice 03
Governance, Risk & Compliance
We build security programs that satisfy auditors because they genuinely reduce risk. One control set, mapped across frameworks, with evidence collected once and reused everywhere.
Information Security Program Development & Implementation
Design and stand up a complete, right-sized information security program (governance, policy, risk management, and operations) and then help you run it.
Whether you are formalizing security for the first time, responding to customer and regulator expectations, or rebuilding after an incident, we create a program that fits your size, industry, and risk appetite. We start with a current-state assessment and business context, define governance and accountability, write a policy framework people can actually follow, establish a repeatable risk management process, and implement the core operational controls. Ongoing virtual CISO (vCISO) support is available to lead the program, report to leadership, and keep it maturing.
What's included
- Current-state maturity assessment and stakeholder interviews
- Security strategy, charter, and governance structure (roles, committees, RACI)
- Policy, standard, and procedure framework aligned to recognized standards
- Risk assessment methodology, risk register, and risk acceptance process
- Asset inventory and data classification scheme
- Third-party and vendor risk management program
- Security awareness and phishing simulation program
- Business continuity and disaster recovery alignment
- Security metrics, KRIs, and board-level reporting
- Virtual CISO services for ongoing leadership
Deliverables
- Security program charter and governance model
- Complete, approved policy and standards library
- Enterprise risk register with treatment plans
- Multi-year security roadmap and budget plan
- Vendor risk questionnaires, tiering, and review workflow
- Metrics dashboard and executive/board reporting template
- Annual program calendar (reviews, tests, training, audits)
Outcome: A security program with clear ownership, defensible decisions, and a roadmap leadership understands and funds, ready for whichever certification comes next.
vCISORisk managementPolicy frameworkThird-party riskBoard reporting
ISO/IEC 27001 Compliance
End-to-end support to design, implement, and certify an Information Security Management System (ISMS) against ISO/IEC 27001:2022, and to keep it certified.
ISO/IEC 27001 is the internationally recognized standard for information security management and is increasingly expected by enterprise customers worldwide. We guide you through every clause of the standard, from defining scope and context to risk treatment, the Statement of Applicability, and the 93 Annex A controls organized across organizational, people, physical, and technological themes. We prepare your team and evidence for the Stage 1 and Stage 2 audits conducted by your accredited certification body, and we support surveillance and recertification cycles. Organizations certified to the 2013 edition can rely on us for a smooth transition to 2022.
What's included
- Gap assessment against ISO/IEC 27001:2022 clauses 4–10 and Annex A
- ISMS scope definition, context, and interested-party analysis
- Information security risk assessment and treatment methodology
- Statement of Applicability with justified inclusions and exclusions
- Policy and procedure development for required documented information
- Control implementation support, including ISO/IEC 27002 guidance
- Internal audit program and independent internal audit
- Management review facilitation
- Certification body selection and Stage 1 / Stage 2 audit support
- 2013 → 2022 transition and extensions (ISO 27017, 27018, 27701)
Deliverables
- Gap assessment report and implementation project plan
- Complete ISMS documentation set
- Risk assessment, risk treatment plan, and Statement of Applicability
- Internal audit report and corrective action log
- Management review minutes and objectives tracking
- Audit-ready evidence repository
Outcome: A functioning ISMS that earns certification from an accredited body and keeps delivering value through surveillance audits and beyond.
ISO/IEC 27001:2022ISO/IEC 27002Statement of ApplicabilityInternal auditISO 27701
NIST Cybersecurity Framework
Assess, prioritize, and improve your cybersecurity posture using NIST CSF 2.0, the common language for communicating cyber risk to executives, boards, and regulators.
The NIST Cybersecurity Framework 2.0 organizes cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Its flexibility makes it ideal for organizations of any size or sector, but that flexibility also means it must be tailored. We build your Current Profile through evidence-based assessment, define a Target Profile aligned to your risk tolerance and obligations, and translate the gaps into a sequenced, funded roadmap. Because the CSF maps to ISO 27001, NIST SP 800-53, CIS Controls, and sector regulations, it becomes the backbone for all your compliance efforts.
What's included
- Current Profile assessment across all six CSF 2.0 functions and categories
- Implementation Tier evaluation for governance and risk management
- Target Profile development tied to business objectives and risk appetite
- Gap analysis with risk-weighted prioritization
- Cyber supply chain risk management (GV.SC) program design
- Crosswalks to ISO 27001, NIST 800-53, CIS Controls, HIPAA, and others
- Roadmap execution support and control implementation
- Periodic reassessment to track maturity over time
Deliverables
- Current and Target Profiles with scoring rationale
- Executive dashboard of maturity by function
- Prioritized gap register and remediation roadmap
- Framework crosswalk mapping
- Board-ready briefing deck
Outcome: A shared, measurable view of cyber risk that leadership can act on, and a foundation that simplifies every other compliance obligation.
NIST CSF 2.0Govern functionProfiles & TiersSupply chain risk
NIST SP 800-171 Readiness Through Certification
Protect Controlled Unclassified Information (CUI) and win and retain U.S. Department of Defense contracts, from initial scoping through CMMC Level 2 certification.
Defense contractors handling CUI must implement the security requirements of NIST SP 800-171 under DFARS 252.204-7012, report their score in the Supplier Performance Risk System (SPRS), and increasingly achieve Cybersecurity Maturity Model Certification (CMMC). CMMC Level 2 aligns with the 110 requirements of NIST SP 800-171 Rev. 2 and, for most contracts involving CUI, requires an assessment by an authorized C3PAO. We guide you across the full journey: minimizing scope with well-designed CUI enclaves, implementing and documenting each requirement, preparing objective evidence against the assessment objectives in NIST SP 800-171A, and supporting you through the formal assessment.
What's included
- CUI identification, data flow mapping, and assessment scope definition
- Asset categorization (CUI, security protection, contractor risk managed, specialized, out of scope)
- Enclave architecture, including GCC High and FedRAMP-equivalent cloud options
- Gap assessment against all 110 requirements and 320 assessment objectives
- System Security Plan (SSP) and Plan of Action & Milestones (POA&M) development
- SPRS score calculation and submission support
- Technical control implementation: MFA, FIPS-validated encryption, logging, configuration baselines
- External service provider and flow-down requirements review
- Mock assessment using C3PAO methodology
- Support during the C3PAO assessment and POA&M close-out
Deliverables
- CUI scoping document and network/data flow diagrams
- Gap assessment report with requirement-level findings
- System Security Plan and supporting policies and procedures
- POA&M with owners, milestones, and closure evidence
- Validated SPRS score
- Organized evidence package mapped to each assessment objective
- Mock assessment report and readiness determination
Outcome: A defensible SPRS score, a well-scoped and well-documented CUI environment, and the confidence to enter your CMMC assessment prepared.
NIST SP 800-171NIST SP 800-171ACMMC 2.0 Level 2DFARS 7012SSP / POA&MGCC High
PCI DSS Assessment Readiness
Prepare for a successful PCI DSS v4.0.1 assessment, whether a Report on Compliance with a QSA or a Self-Assessment Questionnaire, by reducing scope and closing gaps before the assessor arrives.
PCI DSS v4.0.1 introduced significant changes, including a customized approach for meeting objectives, targeted risk analyses, stronger authentication requirements, and new controls for e-commerce payment page scripts, many of which became mandatory on March 31, 2025. The single biggest lever for reducing PCI effort is scope. We map how cardholder data flows through your business, design segmentation and tokenization strategies to shrink the cardholder data environment, determine the correct validation path, and then help you implement and evidence each requirement so your assessment runs smoothly.
What's included
- Cardholder data discovery and data flow diagramming
- Scope reduction: segmentation, tokenization, P2PE, and outsourcing strategies
- Validation path determination (ROC vs. specific SAQ type)
- Gap assessment against all 12 requirements of PCI DSS v4.0.1
- Targeted risk analyses and customized approach documentation
- Payment page script management and tamper detection (Req. 6.4.3, 11.6.1)
- Segmentation penetration testing and internal/external testing (Req. 11.4)
- Service provider responsibility matrix review
- Policy, procedure, and evidence preparation; QSA pre-assessment
Deliverables
- Cardholder data flow and network segmentation diagrams
- Scoping memo and validation path recommendation
- Requirement-by-requirement gap report and remediation plan
- Targeted risk analysis documentation
- Responsibility matrix for third-party service providers
- Assessment-ready evidence binder
Outcome: A smaller, well-understood cardholder data environment and an assessment with no surprises.
PCI DSS v4.0.1ROC / SAQSegmentation testingTokenizationReq. 6.4.3 / 11.6.1
SAP S/4HANA Governance & Compliance
Secure, govern, and audit your SAP S/4HANA landscape (roles, segregation of duties, privileged access, and change control), whether on-premises or on RISE with SAP.
SAP systems run the most sensitive financial and operational processes in the enterprise, making them central to SOX, internal audit, and fraud prevention. Migrations from ECC to S/4HANA are the ideal moment to fix years of accumulated role sprawl and segregation-of-duties conflicts. We design clean, Fiori-aware role architectures, implement and tune SAP GRC Access Control (or comparable tools), establish emergency access and access review processes, and harden the technical layer, giving auditors a landscape they can rely on and users the access they need.
What's included
- Role and authorization redesign for S/4HANA and Fiori (business roles, catalogs, spaces, and pages)
- Segregation of duties (SoD) ruleset design, risk analysis, and remediation
- Mitigating control design for accepted SoD risks
- SAP GRC Access Control implementation: ARA, ARM, BRM, and EAM
- Emergency (firefighter) access process and log review
- Periodic user access review and certification campaigns
- SOX IT general controls: access, change management (transports), operations
- Security Audit Log, HANA database, and system parameter hardening
- RISE with SAP and SAP BTP shared-responsibility and security review
- Sensitive access and critical transaction monitoring
Deliverables
- Role design blueprint and role build documentation
- Tailored SoD ruleset and risk-to-control matrix
- SoD conflict remediation report (before / after)
- Configured GRC workflows and operating procedures
- ITGC control narratives and test evidence
- Technical hardening report and baseline
Outcome: Clean audits, fewer SoD conflicts, and an SAP access model that scales with the business instead of fighting it.
SAP S/4HANASAP GRC Access ControlSoDSOX ITGCRISE with SAPFiori
Practice 04
Cloud Architecture & Security
Secure-by-default cloud foundations, delivered as infrastructure as code. We design for scale, enforce guardrails automatically, and give your security team full visibility, on whichever cloud (or clouds) you run.
Azure Architecture & Security Solutions
Design, build, and secure Microsoft Azure environments using the Cloud Adoption Framework and Well-Architected Framework, from enterprise landing zones to workload hardening and continuous monitoring.
A secure Azure estate starts with the right foundation: a management group hierarchy that reflects how you govern, policy-driven guardrails that prevent misconfiguration, and a network topology that keeps workloads private by default. We design and deploy Azure landing zones as code, integrate Microsoft Entra ID for least-privilege administration, and enable Microsoft Defender for Cloud and Microsoft Sentinel for posture management and threat detection. For existing environments, we assess against the Microsoft cloud security benchmark and CIS benchmarks and remediate what we find.
What's included
- Azure landing zone design and deployment (Cloud Adoption Framework)
- Management group, subscription, and RBAC hierarchy design
- Azure Policy guardrails and regulatory compliance initiatives
- Hub-and-spoke or Virtual WAN networking, Azure Firewall, Private Link
- Privileged access with Entra PIM, Conditional Access, and break-glass accounts
- Defender for Cloud (CSPM and workload protections) enablement and tuning
- Microsoft Sentinel deployment and analytics rule development
- Key Vault, managed identities, and encryption with customer-managed keys
- AKS, App Service, and data platform security hardening
- Infrastructure as code with Bicep or Terraform and secure CI/CD
Deliverables
- Target architecture and design decision records
- Landing zone deployed as version-controlled code
- Policy-as-code library with compliance reporting
- Security posture assessment against MCSB / CIS
- Remediation plan and implemented fixes
- Operations runbooks and knowledge transfer
Outcome: An Azure environment that is secure by default, compliant by policy, and ready to scale without accumulating risk.
Landing zonesAzure PolicyDefender for CloudSentinelEntra PIMBicep / Terraform
AWS Architecture & Security Solutions
Build and secure Amazon Web Services environments with a well-governed multi-account strategy, preventive and detective guardrails, and centralized security operations.
AWS security scales through account isolation and automation. We design multi-account structures using AWS Organizations and AWS Control Tower, apply service control policies and resource control policies as preventive guardrails, and centralize logging and security findings in dedicated accounts. Identity is unified through IAM Identity Center with least-privilege permission sets, and workloads are protected with GuardDuty, Security Hub, Inspector, and AWS WAF. Every recommendation is grounded in the Security Pillar of the AWS Well-Architected Framework.
What's included
- Multi-account strategy with AWS Organizations and Control Tower
- Service control policies and preventive guardrails
- IAM Identity Center federation and permission set design
- IAM least-privilege analysis using IAM Access Analyzer
- Organization-wide CloudTrail, AWS Config, and centralized log archive
- GuardDuty, Security Hub, Inspector, Macie, and Detective enablement
- VPC architecture, Transit Gateway, Network Firewall, and PrivateLink
- KMS key strategy and data protection controls
- EKS, Lambda, and container security
- Infrastructure as code with Terraform, CloudFormation, or CDK
Deliverables
- Account structure and OU design with guardrail mapping
- Deployed foundation as version-controlled code
- SCP library and IAM permission set catalog
- Well-Architected security review findings
- Security Hub standards baseline (CIS, AWS FSBP) and remediation
- Incident response runbooks for AWS scenarios
Outcome: An AWS organization where new accounts are secure from day one and security teams see every finding in one place.
Control TowerSCPsIAM Identity CenterGuardDutySecurity HubWell-Architected
GCP Architecture & Security Solutions
Design and secure Google Cloud environments with a sound resource hierarchy, organization policies, perimeter controls, and integrated threat detection.
Google Cloud's resource hierarchy (organization, folders, and projects) is the foundation for inheritance of IAM and policy, and getting it right early avoids painful rework later. We build secure GCP foundations aligned to Google's enterprise foundations blueprint, enforce organization policy constraints, design Shared VPC networking, and protect sensitive data with VPC Service Controls and customer-managed encryption keys. Security Command Center provides posture management and threat detection, and we integrate it with your SIEM or Google Security Operations.
What's included
- Organization, folder, and project hierarchy design
- Organization policy constraints and custom constraints
- IAM design with groups, custom roles, and IAM Conditions
- Shared VPC, Private Service Connect, and Cloud NAT architecture
- VPC Service Controls perimeters for data exfiltration protection
- Cloud KMS, CMEK, and Secret Manager strategy
- Security Command Center enablement and findings triage
- Cloud Armor, Identity-Aware Proxy, and BeyondCorp-style access
- GKE hardening and Binary Authorization
- Assured Workloads for regulated data; Terraform-based delivery
Deliverables
- Reference architecture and resource hierarchy design
- Foundation deployed via Terraform with CI/CD pipeline
- Organization policy and IAM baseline
- VPC Service Controls perimeter design and access levels
- Security posture report and remediation backlog
- Operations and incident response runbooks
Outcome: A Google Cloud foundation where data stays inside defined perimeters, identities are least-privilege, and threats surface quickly.
Resource hierarchyOrg policiesVPC Service ControlsSecurity Command CenterIAPTerraform
Practice 05
Identity & Access
Most breaches start with a compromised identity. We design identity architectures that make authentication strong, access minimal, and governance continuous, for people and for machines.
Identity & Access Management
Strategy, design, and implementation of identity governance, authentication, and privileged access so that the right people have the right access, for the right reasons, for the right amount of time.
Effective IAM spans the whole identity lifecycle. We automate joiner, mover, and leaver processes from your HR system of record, define role- and attribute-based access models, run access certifications that reviewers can complete meaningfully, and lock down privileged accounts with just-in-time elevation and session controls. Authentication is strengthened with phishing-resistant MFA such as FIDO2 security keys and passkeys, and everything is aligned to Zero Trust principles. As applications and AI agents increasingly connect to each other directly, we also bring app-to-app access under the control of your identity provider using Cross App Access (XAA) and the Identity Assertion JWT Authorization Grant (ID-JAG), replacing scattered user consents and long-lived tokens with centrally governed, auditable policies. We are platform-neutral and implement across leading IGA, PAM, and access management products.
What's included
- IAM maturity assessment and Zero Trust identity roadmap
- Identity lifecycle automation (joiner / mover / leaver) from HR sources
- Identity governance and administration: SailPoint, Saviynt, Entra ID Governance
- Role engineering, RBAC/ABAC models, and entitlement clean-up
- Access certification campaign design and execution
- Privileged access management: CyberArk, BeyondTrust, Delinea, Entra PIM
- Phishing-resistant MFA rollout (FIDO2, passkeys, Windows Hello for Business)
- Service account and non-human identity discovery and governance
- Active Directory security assessment and tiered administration
- Cross App Access (XAA): IdP-governed app-to-app and AI agent-to-app connections, with central visibility and revocation
- ID-JAG implementation: token exchange at the enterprise IdP and JWT authorization grants at resource apps' authorization servers
Deliverables
- IAM current-state assessment and target architecture
- Multi-year IAM roadmap and business case
- Role model and entitlement catalog
- Configured lifecycle workflows and integrations
- Privileged account inventory and vaulting plan
- Access review reports and remediation evidence
- App-to-app and agent access policies with XAA / ID-JAG integration design
Outcome: Faster onboarding, instant offboarding, fewer standing privileges, and access reviews auditors trust.
IGAPAMZero TrustFIDO2 / passkeysRBAC / ABACCross App Access (XAA)ID-JAG
SSO Federation: Entra ID, Active Directory, Okta, Google Workspace
Unify sign-in across your applications and identity providers with secure, standards-based federation, including hybrid identity, multi-IdP coexistence, and migrations.
Organizations rarely live in a single identity provider. Mergers, legacy on-premises Active Directory, Google Workspace for collaboration, and Okta or Microsoft Entra ID for workforce access create a web of trusts that must be secure and seamless. We design the authoritative identity source and federation topology, integrate applications with SAML 2.0 and OpenID Connect, automate provisioning with SCIM, and enforce consistent Conditional Access and MFA policies. We also lead complex migrations, such as moving from AD FS to Entra ID cloud authentication or consolidating multiple IdPs, without disrupting users.
What's included
- Identity provider strategy and federation topology design
- Hybrid identity with Entra Connect Sync or Entra Cloud Sync
- AD FS to Entra ID migration (password hash sync, pass-through, or certificate-based authentication)
- Okta ↔ Entra ID federation and coexistence patterns
- Google Workspace federation (as IdP or relying party) with Entra ID or Okta
- SAML 2.0, OIDC, and WS-Federation application integrations
- SCIM-based automated user and group provisioning
- Conditional Access, device trust, and adaptive MFA policies
- B2B and partner federation; tenant-to-tenant consolidation for M&A
- Application onboarding factory and governance process
Deliverables
- Federation architecture and trust diagrams
- Application inventory with protocol and migration wave plan
- Configured integrations and provisioning connectors
- Conditional Access / sign-on policy baseline
- Cut-over plans, rollback procedures, and user communications
- Administrator runbooks and app-onboarding templates
Outcome: One secure sign-in experience across every application, consistent policy enforcement, and fewer passwords to steal.
Microsoft Entra IDActive Directory / AD FSOktaGoogle WorkspaceSAML / OIDCSCIM
Workload Identity Federation
Eliminate long-lived cloud credentials by letting pipelines, applications, and workloads authenticate across clouds with short-lived, federated tokens.
Static service account keys and access keys stored in CI/CD systems, configuration files, and developer laptops are among the most common causes of cloud breaches. Workload identity federation replaces them with trust relationships: a workload proves who it is using a token from its own platform (GitHub Actions, GitLab, Kubernetes, AWS, Azure, or an on-premises identity provider) and receives short-lived credentials in the target cloud. We inventory existing secrets, design trust policies with tight attribute conditions, implement federation across Google Cloud, Azure, and AWS, and retire the keys for good.
What's included
- Discovery of long-lived keys, secrets, and service account credentials
- Google Cloud Workload Identity Federation: pools, providers, and attribute conditions
- Microsoft Entra workload identity federation with federated credentials on apps and managed identities
- AWS IAM OIDC identity providers, role trust policies, and IAM Roles Anywhere
- CI/CD federation for GitHub Actions, GitLab CI, Azure DevOps, and others
- Kubernetes workload identity: GKE Workload Identity, AKS workload identity, EKS Pod Identity / IRSA
- Cross-cloud federation (e.g., AWS workloads accessing GCP or Azure)
- SPIFFE/SPIRE for platform-agnostic workload identity
- Key disablement, org policies to block key creation, and monitoring
Deliverables
- Non-human credential inventory and risk ranking
- Federation architecture and trust policy standards
- Implemented federation configurations as code
- Pipeline and workload migration playbooks
- Guardrails preventing new long-lived keys
- Key retirement report
Outcome: No static cloud keys to leak, tightly scoped machine access, and a clear audit trail of which workload did what.
GCP WIFEntra workload identityAWS OIDC / Roles AnywhereGitHub Actions OIDCKubernetesSPIFFE
Practice 06
AI Security & Governance
AI is being adopted faster than it is being secured or governed. We help you use it confidently: protecting models, agents, and data from new classes of attack, bringing shadow AI into the light, and meeting fast-moving regulatory obligations with a governance program built on recognized frameworks.
Agentic AI Security
Secure AI agents that reason, plan, and act on your behalf, calling tools, APIs, and other agents, before their autonomy becomes an attacker's leverage.
Agentic systems change the threat model. An agent that can read email, query databases, run code, or trigger payments turns a single manipulated input into real-world action. Typical failures include excessive agency, over-privileged tool credentials, poisoned memory, unsafe tool and Model Context Protocol (MCP) server integrations, and multi-agent trust chains nobody designed. We threat-model your agent architectures, design least-privilege identity and authorization for every tool an agent can call, place human approval where impact is high, and red team the result to prove an agent can't be talked into misusing its access.
What's included
- Agent architecture review and threat modeling (OWASP Top 10 for Agentic Applications, MITRE ATLAS)
- Inventory of agents, tools, MCP servers, plug-ins, and the data each can reach
- Agent identity design: per-agent credentials, short-lived tokens, workload identity federation
- Least-privilege tool scoping, allow-lists, and authorization checks outside the model
- Human-in-the-loop approval for high-impact actions
- MCP server and third-party tool supply chain vetting
- Memory and context poisoning defenses; multi-agent trust boundaries
- Sandboxing for code execution and browser-using agents
- Agent observability: action logging, tracing, anomaly detection, and kill switches
- Adversarial testing of agents against goal hijacking and tool misuse
Deliverables
- Agent threat model and attack-path diagrams
- Agent and tool permission inventory with risk ratings
- Secure agent reference architecture and design standards
- Guardrail and approval-gate configuration
- Red team findings with reproduction steps and fixes
- Monitoring and incident response playbook for agent misuse
Outcome: Agents that do what they were built to do and nothing more, with every action attributable, bounded, and reversible.
OWASP Agentic Top 10MCP securityMITRE ATLASExcessive agencyAgent identity
Prompt Security & LLM Red Teaming
Test and harden your LLM applications against prompt injection, jailbreaks, data leakage, and the rest of the OWASP Top 10 for LLM Applications.
Large language models cannot reliably tell instructions from data. Anything they read (a user message, a web page, a PDF, a retrieved document, an email) can carry instructions an attacker planted. We test chatbots, copilots, and retrieval-augmented generation (RAG) systems the way an adversary would, with both direct and indirect prompt injection, jailbreak techniques, and attempts to extract system prompts, training data, or other users' information. We then design layered defenses, because no single guardrail is enough, and set up automated evaluation so protection keeps pace as models and prompts change.
What's included
- Manual LLM red teaming aligned to the OWASP Top 10 for LLM Applications
- Direct and indirect prompt injection via documents, web content, email, and tool outputs
- Jailbreak and safety-bypass testing
- System prompt leakage and sensitive information disclosure testing
- RAG security: data poisoning, retrieval access control, and tenant isolation
- Insecure output handling (XSS, SQL, and command injection through model output)
- Guardrail and AI firewall design, selection, and tuning
- Prompt and context engineering for defense in depth
- Automated adversarial evaluation in CI/CD for prompts and model upgrades
Deliverables
- LLM security assessment report with risk-rated findings
- Successful attack prompts and transcripts as evidence
- OWASP LLM Top 10 coverage matrix
- Layered defense architecture and guardrail configuration
- Reusable adversarial test suite for regression testing
- Retest confirming remediation
Outcome: LLM applications that resist manipulation, keep sensitive data where it belongs, and stay tested as they evolve.
OWASP LLM Top 10Prompt injectionJailbreaksRAG securityGuardrails
Shadow AI Discovery & Control
Find the AI tools, browser extensions, and integrations your people already use, understand what data is flowing into them, and replace blanket bans with safe, sanctioned alternatives.
Employees adopt generative AI because it makes them faster, often by pasting source code, customer records, or contracts into tools the organization has never reviewed. Shadow AI also hides in SaaS features that switched on AI by default, in OAuth grants to AI apps, and in models deployed in cloud accounts outside security's view. We discover it across network, endpoint, identity, SaaS, and cloud telemetry, assess the risk of each tool and use case, and put proportionate controls in place: an acceptable use policy people understand, data loss prevention for prompts and uploads, and approved tools that remove the reason to go around security.
What's included
- Discovery of AI usage via SSE/CASB, secure web gateway, DNS, and firewall logs
- OAuth and SaaS-to-AI integration review in Entra ID, Okta, and Google Workspace
- Browser extension and desktop AI app inventory via EDR and endpoint management
- Embedded AI features in existing SaaS platforms and their data-use terms
- AI security posture management for models and AI services in Azure, AWS, and GCP
- Vendor and tool risk assessment: data retention, training use, residency, security
- Generative AI acceptable use policy and data classification rules
- DLP controls for prompts, file uploads, and copy/paste into AI tools
- Sanctioned AI tool selection and secure enterprise configuration
- AI literacy and awareness training for staff
Deliverables
- Shadow AI inventory: tools, users, departments, and data types involved
- Risk-ranked tool register with sanction / restrict / block decisions
- Generative AI acceptable use policy
- Configured DLP and access policies
- Continuous discovery and reporting process
Outcome: Full visibility of AI use across the business, sensitive data kept out of unapproved tools, and employees with safe ways to keep moving fast.
Shadow AISSE / CASBDLPAI-SPMAcceptable use
AI Governance
Establish accountable, risk-based oversight of how your organization builds, buys, and uses AI, built on ISO/IEC 42001, the NIST AI Risk Management Framework, and the OECD AI Principles.
AI governance answers the questions boards, customers, and regulators are now asking: what AI do we use, who owns it, what could go wrong, and how do we know it is working as intended? We stand up a governance structure with clear decision rights, build an inventory of AI systems and use cases, and tier them by risk so that oversight is proportionate rather than a bottleneck. Each system gets impact assessments, controls across its lifecycle (data, development, validation, deployment, monitoring, and retirement), and documentation that holds up to scrutiny. For organizations seeking external assurance, we prepare you for certification of an AI Management System (AIMS) against ISO/IEC 42001.
What's included
- AI governance maturity assessment and roadmap
- AI governance committee, charter, roles, and decision rights
- AI policy, responsible AI principles, and lifecycle standards
- AI system and use-case inventory with ownership
- Risk tiering and AI impact assessments (ISO/IEC 42005, NIST AI RMF Map/Measure)
- Controls for data quality, bias and fairness, transparency, explainability, and human oversight
- Model validation, performance monitoring, and drift management
- Third-party and vendor AI risk management
- ISO/IEC 42001 AIMS implementation, internal audit, and certification readiness
- Alignment with existing ISO 27001, privacy, and enterprise risk programs
Deliverables
- AI governance framework and committee charter
- AI policy and supporting standards
- AI system register with risk tiers and owners
- Impact assessment templates and completed assessments
- Framework crosswalk (ISO 42001, NIST AI RMF, OECD, EU AI Act)
- Board and executive AI risk reporting
Outcome: AI adoption that leadership can stand behind, with clear accountability, proportionate controls, and evidence ready for customers, auditors, and regulators.
ISO/IEC 42001NIST AI RMFNIST AI 600-1OECD AI PrinciplesISO/IEC 23894ISO/IEC 42005
Compliance with AI Acts & Regulations
Understand which AI laws apply to you, classify your AI systems, and meet your obligations as a provider or deployer under the EU AI Act and emerging U.S. and international regulations.
The EU Artificial Intelligence Act is the first comprehensive AI law, with obligations phasing in over several years and reaching any organization that places AI on the EU market or whose AI output is used in the EU. It sorts AI into prohibited practices, high-risk systems, systems with transparency obligations, and general-purpose AI models, with different duties for providers and deployers. Elsewhere, U.S. states and cities are regulating automated decision-making in hiring, lending, insurance, and other consequential decisions. We map your AI portfolio to the laws that apply, determine your role and risk classification for each system, and build the documentation, assessments, and processes required, reusing your AI governance program so you comply once across many regimes.
What's included
- Regulatory applicability analysis across jurisdictions and business lines
- EU AI Act role determination (provider, deployer, importer, distributor)
- Risk classification of each AI system, including prohibited-practice screening
- High-risk system requirements: risk management, data governance, technical documentation, logging, human oversight, accuracy, robustness, and cybersecurity
- Conformity assessment preparation and quality management system alignment
- Fundamental rights impact assessments for deployers
- Transparency obligations: AI interaction notices and labeling of AI-generated content
- General-purpose AI model obligations and downstream provider requirements
- AI literacy programs for staff
- U.S. requirements, such as the Colorado AI Act and NYC Local Law 144 bias audits
- Post-market monitoring and serious incident reporting processes
Deliverables
- AI regulatory applicability map
- AI system classification register with rationale
- Gap assessment against applicable obligations
- Technical documentation and assessment templates, completed for in-scope systems
- Compliance roadmap tracked against regulatory deadlines
- Monitoring and incident reporting procedures
Outcome: A clear picture of your AI regulatory exposure and a documented, defensible compliance position, ready before each deadline arrives.
EU AI ActColorado AI ActNYC Local Law 144Conformity assessmentFRIAGPAI
