Application and supply-chain security
SAST: source code review
Static application security testing of your source code, with every automated result reviewed by a person so your team only sees real issues.
What's included
- Automated scanning plus manual review of high-risk code
- Authentication, authorisation and input-handling review
- Secrets and hard-coded credentials detection
- Setup of scanning in your CI/CD pipeline
What you receive
- Validated findings with file and line references
- Fix guidance with code examples
- CI/CD integration notes
SCA: dependency analysis
Software composition analysis finds known vulnerabilities and licence problems in the open-source libraries your product depends on.
What's included
- Direct and transitive dependency scanning
- Known-vulnerability matching (CVE and advisory databases)
- Reachability review to cut noise
- Open-source licence risk check
What you receive
- Prioritised list of packages to upgrade
- Safe target versions
- Licence risk summary
IaC security review
We review your infrastructure-as-code so misconfigurations are caught before they are deployed to production.
What's included
- Terraform and CloudFormation templates
- Kubernetes manifests and Helm charts
- Public exposure, encryption, logging and IAM checks
- Policy-as-code guardrails for your pipeline
What you receive
- Misconfiguration findings mapped to files
- Corrected configuration examples
- Recommended pipeline checks
SBOM assessment
We generate or review your software bill of materials and assess supply-chain risk, increasingly required by enterprise customers and regulators.
What's included
- SBOM generation in CycloneDX or SPDX
- Review of existing SBOMs for completeness
- Vulnerability and end-of-life component check
- Supply-chain risk assessment
What you receive
- Complete SBOM file
- Risk summary for customers and auditors
- Process for keeping it up to date