Services
Engineering. Integration. Protection.
Four pillars, in the order they usually have to be built. Security operations and security data are foundational; AI and agent security sit on top of them; cloud and platform engineering is the substrate underneath all three.
Security Operations
SOC and SIEM architecture, detection engineering as code, security analytics and automation.
- SOC design & architecture
- SIEM engineering
- Splunk architecture
- SOC modernisation
- SOC observability
- +8
Data Engineering
Security data architecture, pipelines, platforms, governance, lineage and data quality.
- Data architecture
- Security data engineering
- Data platforms
- Telemetry architecture
- Data pipelines
- +11
AI & Agent Security
AI security architecture, agent runtime and memory security, tool boundaries, AI observability and governance.
- AI security architecture
- AI threat modelling
- AI security assessment
- Agentic system architecture
- Agent security
- +11
Cloud & Infrastructure
Secure cloud and platform architecture, DevSecOps, infrastructure as code, containers and observability.
- Cloud architecture
- Security architecture
- Container architecture
- Platform engineering
- Secure infrastructure
- +7
The stack
One architecture, four ways in.
Every engagement touches more than one pillar, because the systems do. This is the shape of the estate we work on.
Security Operations
We design and build the systems a security operations centre actually runs on: the platform architecture, the telemetry that reaches it, the detection content that runs against it, and the automation that keeps all three maintainable as they grow. The emphasis is on detection that can be tested, versioned and reasoned about rather than accumulated.
Data Engineering
We treat security telemetry as an engineered data estate — sources, pipelines, schemas, lineage, retention and cost — rather than as whatever happens to reach the SIEM. The same discipline applies to the analytical and AI workloads that increasingly consume the same data.
AI & Agent Security
Agentic systems behave less like applications to be scanned and more like operational estates to be instrumented, governed and monitored. We threat-model them, design the runtime boundaries where privilege is actually exercised, and make their behaviour observable to the people held responsible for it.
Cloud & Infrastructure
The substrate everything else runs on. We design cloud and platform architecture with the security properties built into the delivery pipeline rather than inspected afterwards, and with observability treated as part of the platform rather than an add-on.
Not sure which pillar your problem sits in?
Most of them sit in two. Describe the system and what worries you about it, and we will tell you where the work actually is.