Security requirements
Translate product behavior, sensitive data, customer obligations and potential harm into specific security rules with acceptance tests.
Requirements & secure design
Make the security decisions before the code depends on them.
An authorization mistake or unsafe data flow can spread through a product long before a scanner finds it. Review the design and turn assumptions into controls and tests.
A defined project or part of your fractional application security engagement · Plan & lead
What we can do
Practical services.
A scope you can understand.
Choose the work that addresses your product and priorities. The agreed scope defines depth, access and deliverables.
Threat modelling
Map components, data flows and trust boundaries. Explore credible attack and abuse scenarios, then assign mitigations and unresolved decisions.
Architecture & design review
Review how controls fit together across the app, APIs, workers and services. Recommend changes with the engineering tradeoffs explained.
Authorization & tenant isolation
Define user, role, object and tenant permissions, including background jobs and direct data access. Design denial tests for forbidden actions.
Authentication & session design
Review login, SSO, account recovery, token handling and session lifecycle so identity checks remain effective through normal and failure paths.
Data protection & reusable patterns
Design sensitive-data handling, retention, secrets and established security patterns that teams can reuse. Review adoption in real features.
What you receive
Work you can review.
Evidence you can use.
Deliverables are selected and agreed for your engagement.
- Reviewed architecture and data flows
- Threat model and mitigation backlog
- Testable security requirements
- Implementation patterns and negative test cases
An illustrative engagement
How the work connects.
This example explains the approach; it is not a customer case study.
What needs attention
A product is adding shared workspaces and enterprise customers need tenant isolation.
What we do together
Design permissions across APIs, background jobs and storage, challenge bypass paths and help engineers implement consistent checks.
What you can inspect
A permission model, reviewed changes and tests that reject cross-tenant access.
Connected work
Bring in the other pieces
when you need them.
Application assessments & penetration testing
Scoped web, API and mobile testing with practical fixes and retesting.
View services & deliverablesCode, dependencies & automated testing
Review source, packages, secrets, IaC and images with application context.
View services & deliverablesAI applications & secure AI development
Assess LLM features, RAG, agents and the controls around AI-generated changes.
View services & deliverablesExpertise without a full-time hire
Tell us what needs attention in your product.
Tell us about your product, what needs attention and any deadline. We’ll agree a useful starting scope and the right level of support.