Services
Architect security into your product from design onwards.
We help product organisations build security into design, development, release and post-market surveillance, with practices and technical evidence that reflect the product’s risks.
What we help you do.
- Establish a secure development lifecycle.
- Structure threat modelling and architectural patterns.
- Set up SBOM management and vulnerability disclosure processes.
- Align product security requirements with CRA and EUCC expectations.
- Organise technical documentation for regulatory review.
Typical outputs.
Secure development lifecycle framework, product security requirements, vulnerability-management process and evidence structure.
Typical outputs describe potential engagement deliverables. Actual deliverables depend on the scope agreed for each engagement.
What to discuss when scoping the work
- Which product, versions and deployment models are in scope?
- Where are security decisions, component dependencies and threat assumptions recorded?
- How are vulnerabilities reported, prioritised and addressed after release?
Illustrative engagement
A product team is preparing a new connected device and needs to connect design decisions with its software components and update process. The work can map trust boundaries, review likely abuse cases and agree which records support later vulnerability handling and technical documentation.
How the engagement can proceed
- Define the product boundary, lifecycle roles and applicable requirements.
- Review architecture, threat assumptions, development controls and component records.
- Prioritise design changes and agree how decisions, vulnerabilities and updates will be documented.
This service covers advisory and governance support. It does not include penetration testing, a managed vulnerability service or specialist laboratory testing.