ARCHITECTURE · CONSULTING SERVICES
A second opinion from people who did not draw it
A structured review of how your security controls are arranged — network, application, cloud and OT/ICS — where the trust boundaries are, what each layer assumes about the one above it, and whether the IT/OT segmentation actually holds. Design-level weaknesses caught on paper, before they become expensive incidents in production.
ENGAGEMENT AT A GLANCE
SubjectNetwork, application, cloud and OT/ICS
FormatTopology review + threat modelling
OutputPrioritised roadmap
YOU RECEIVE
Current-state architecture with the gaps marked
Threat model for each in-scope trust boundary
Control gap identification against your chosen framework
Segmentation and zero-trust recommendations
Prioritised remediation roadmap
WHAT'S COVERED
Scope of the engagement
01
Documentation & topology review
What is actually deployed, where traffic really flows, and which assumptions in the original design stopped being true some time ago.
02
Trust boundaries
Every point where your estate changes hands — internet, third party, cloud, OT — and what is genuinely enforcing the boundary.
03
Threat modelling
The attack paths that matter for your business, worked through against your design rather than against a generic checklist.
04
Cloud architecture
Azure and AWS estates reviewed for identity, network and data boundaries, and for the assumptions inherited from the on-premises design.
05
IT/OT segmentation
How far an intrusion travels once inside, whether the IT/OT segmentation genuinely holds, and — for industrial estates — how the architecture measures against the Purdue model.
06
Recommendations & roadmap
Segmentation and zero-trust recommendations, phased into what to do now, next and later — with the dependencies between them made explicit.
COMMON QUESTIONS
Before you ask
How is this different from a configuration review?
This examines the design — whether the controls are the right ones, in the right places, with the right things between them. A configuration review examines whether the controls you already have are set up correctly. Most estates need both, and which comes first depends on how much has changed since the design was drawn.
Our architecture was never properly documented.
That is common, and reconstructing it is part of the work rather than a prerequisite for it. We build the current-state picture from configuration exports and workshops, and you keep the diagram afterwards whatever you decide to do with the findings.
Do you only recommend products you sell?
Findings are documented independently of any product. Where a gap genuinely needs technology to close it, we present options — including ones we do not resell.
THE DELIVERABLE
What lands on your desk at the end
Before you sign, ask us exactly what the report contains — it is the fastest way to judge whether the work is worth buying.
REPORT CONTENTS
Executive summary written for a board, not for engineers
Current-state architecture diagram with the gaps marked
Threat model and attack paths per trust boundary
Control gap matrix against your chosen framework
Prioritised roadmap with segmentation and zero-trust recommendations
WHAT WE NEED FROM YOU
Existing architecture and network documentation, however out of date
Configuration exports for the in-scope controls, cloud tenants included
A named architect or technical owner per domain
Two to three hours with the engineers who run the estate
FRAMEWORKS THIS EVIDENCES
ISO/IEC 27001:2022 Annex ANIST Cybersecurity FrameworkCIS Controls v8
Findings are mapped to control references so the report can be handed to an auditor without translation.
Ready to secure your business?
Book a consultation with our engineers. Bring your architecture and your constraints — we'll tell you what we would do first, and why.
WHAT A CONSULTATION LOOKS LIKE
01
A conversation with an engineer
Not a sales call. Bring your architecture and your constraints.
02
A written gap summary
Prioritised, with what we would do first and why.
03
No obligation, no follow-up sequence
If it is not a fit we will say so on the call.
Not ready to talk? See the company facts — entity details, offices and our NTRA certification.
One inbox, answered by an engineer — not a routing queue.