Services
Security with technical judgment.
We review code, rank risks and prepare the post-quantum migration. Every finding comes prioritized and referenced to a public standard, so your team knows what to fix first.
01 · Code
Code analysis (SAST)
We review your source code and its dependencies for vulnerabilities before they reach production.
References: OWASP Top 10 · OWASP ASVS · CWE · CVSS · SARIF · CycloneDX
What we do
- Static analysis of the source code.
- Review of third-party dependencies and their known vulnerabilities.
- Manual validation of every finding to rule out false positives.
What you get
- Report with findings prioritized by severity.
- Results in SARIF, ready for your development workflow.
- Dependency inventory (SBOM) in CycloneDX.
02 · Advisory
Cybersecurity advisory
We help you understand your exposure, prioritize risks and decide where to invest first.
References: OWASP ASVS · CWE · CVSS
What we do
- Review of the systems, data and access that matter most.
- Prioritization of risks by their impact on your operation.
- Support in security and investment decisions.
What you get
- Prioritized risk map.
- Staged action plan, with owners and closing criteria.
03 · Post-quantum
Post-quantum assessment
We identify which information and systems are exposed to harvest now, decrypt later, and where to start.
References: NIST FIPS 203 · NIST IR 8547 · CycloneDX
What we do
- Inventory of where and how you use cryptography.
- Classification of information by how many years it must stay secret.
- Comparison of those timelines with the risk window NIST proposes.
What you get
- Cryptographic inventory (CBOM) in CycloneDX.
- Prioritized migration roadmap.
04 · How we work
From scope to fixes.
Scope
We agree with you, in writing, on what gets reviewed, the timeline and the confidentiality rules.
Analysis
We work within the agreed scope and validate every finding before reporting it.
Delivery
We walk your team through the results, answer questions and agree on what to fix first.