Since 2019

Sectors

Healthcare and digital health
SaaS, fintech and payments
Energy and utilities
Construction and engineering
Legal
Political campaigns and campaign vendors
IoT, fuel and retail technology
Transit and the public sector
Insurance
Security service providers
Mining and natural resources

Work we've done

Healthcare and digital health

Health-tech startup

Managed security program

Challenge: A health-tech startup needed a security program that could grow with it.
What we did: Built the program around four areas: application security in the build pipeline, security operations, compliance readiness (SOC 2, HIPAA) and security management. Ran a CIS Kubernetes benchmark of its cloud cluster.
What they got: A remediation step for every failed benchmark check.

Digital health company

Fractional CISO with an evidence-based roadmap

Challenge: A digital health company needed senior security leadership and a plan it could prove.
What we did: Served as fractional CISO; produced a HIPAA risk assessment and a 90-day roadmap across several workstreams.
What they got: A plan where every task ends in evidence an auditor or insurer can check, plus regular progress and risk reporting.

SaaS, fintech and payments

Payments software company

Cloud, container and application security

Challenge: A payments company needed independent checks of its cloud and applications.
What we did: Reviewed the cloud environment against CIS benchmarks, scanned container images, and tested the web app and API, then re-tested after fixes.
What they got: Monthly security reports tracking new and closed risks from one month to the next.

IoT, fuel and retail technology

Fuel and retail technology platform

Security gap assessment

Challenge: An IoT software company serving fuel and retail sites needed to know where its security program stood.
What we did: Assessed the program against the CIS Controls, scored maturity by domain (governance, vulnerability management, incident response, development) and planned how vulnerability metrics would be tracked.
What they got: An executive readout of top strengths and top risks, and a kickoff plan for the work ahead.

Transit and the public sector

Public-sector organization

Audit of a managed security provider

Challenge: An organization needed to know whether its outside security provider was doing the job.
What we did: With an engineering and audit firm, designed an audit program covering asset and log coverage, forensic readiness, patch timeliness, monitoring coverage and board risk reporting.
What they got: A clear, testable way to hold the provider to its contract.

Security service providers

Call-center service provider

SOC 2 and HIPAA readiness

Challenge: A service provider handling customer data needed SOC 2 and HIPAA readiness.
What we did: Drafted the SOC 2 system description, ran risk register reviews with leadership, documented risk-acceptance decisions and built an incident reporting template.
What they got: Readiness support through drafting and review, up to the closing meeting.

Mining and natural resources

Vendor and third party risk management.