SearchContactBook a demo

Cybersecurity consulting

Find the weak points before someone else does

Penetration testing, managed SOC and vCISO, governance and compliance audits, and rapid incident response, from engineers who build privileged access and database security software for a living.

Discuss your projectSee a sample report

  • Penetration testing
  • Managed SOC and vCISO
  • GRC and compliance audits
  • Rapid incident response

An attack is a chain. Where would you break it?

  1. The attacker

  2. Default admin password on a network appliance

    Fix: Change it, and keep the appliance’s admin login in a vault.

  3. Domain admin rights held by a service account

    Fix: Remove the standing rights; grant admin just in time.

  4. Database reachable from the office network

    Fix: Segment the network so only the app servers reach it.

  5. Bulk exports of customer records nobody reviews

    Fix: Watch database activity and alert on bulk reads.

  6. Customer data

Whole: four steps from the attacker to the customer data.

Sample attack path. Typical findings, not from a client.

Four kinds of help, for four different moments

  1. Before an attack

    Penetration testing

    Controlled attacks on your applications, networks and cloud, to find the weaknesses an attacker would use and show how to close them.

  2. Every day

    Managed SOC and vCISO

    Security monitoring run for you, and a virtual chief information security officer to own the security programme without a full-time hire.

  3. When the auditor asks

    GRC and compliance audits

    Governance, risk and compliance: measuring your controls against the frameworks you answer to, and planning the gaps.

  4. When it happens

    Rapid incident response

    Help to contain an incident, find how it happened and recover, then harden the architecture so it does not happen the same way twice.

See the work

From finding to fixed

A penetration test ends in findings. Filter a sample report by severity, then mark each finding fixed to see the risk come down. Every fix is retested.

  • Critical
  • High
  • Medium
  • Low

Open risk

Sample report. Findings are typical examples, not from a client.

  • criticalDefault admin password on a network applianceNetwork
  • highSQL injection in a search formWeb app
  • highStorage bucket readable by anyoneCloud
  • highDomain admin rights held by a service accountIdentity
  • mediumTLS 1.0 still enabled on a public endpointNetwork
  • mediumNo lockout after repeated failed loginsWeb app
  • mediumDatabase reachable from the office networkDatabase
  • lowServer version shown in response headersWeb app

Where we start

Before we test anything, we agree the rules

Every engagement opens with a discovery assessment. For security work, these are the first questions.

Rules of engagementDiscovery assessment, phase 01

  1. 1.Which systems, applications and cloud accounts are in scope, and which are off limits
  2. 2.The frameworks and audits you answer to
  3. 3.Who holds privileged access today, and how it is granted
  4. 4.What monitoring and incident process already exist

How we deliver

From the first call to a harder target

  1. 01

    Discovery assessment

    We look at your current infrastructure, find the gaps and map them to your business objectives.

  2. 02

    Solution design

    Our architects design a solution for your technical and compliance requirements, sized to grow.

  3. 03

    Implementation

    We deploy and integrate with zero-downtime methods, keeping disruption to your daily operations to a minimum.

The software behind the advice

This work is delivered by the engineers who build these products. Each one helps break a different link.

Questions about security work

What does Rudratic’s cybersecurity consulting cover?

Penetration testing, managed SOC and vCISO, governance, risk and compliance audits, rapid incident response, and security architecture hardening.

Who carries out the work?

Consultants and engineers from the team that builds SWOT PAM and SWOT DAM, so recommendations come from how privileged access, database and cloud security systems actually work.

Can you help with privileged access and zero trust?

Yes. PAM and DAM deployment, zero-trust architecture consulting and cloud identity and access reviews are core strengths.

Tell us what you are working on

We scope quickly and you speak to senior engineers from the first call.

Discuss your projectBook a product demo