Service
Security Architecture Review and Advisory
Who it is for
Engineering and platform teams designing or buying a system that will hold regulated or customer data.
When clients call
- A new platform or cloud migration before go-live
- A customer asking for architecture evidence
- Repeat audit findings on access reviews or privileged accounts
- A vendor selection that needs a security verdict
Scope
- Threat model for the system in scope
- Identity, network, data and logging design, including privileged and service accounts
- Cloud configuration against provider benchmarks
- Third-party and integration trust boundaries
Method and standards
- NIST SP 800-160
- CIS Benchmarks
- AWS, Azure and GCP well-architected security pillars
Deliverables
- Threat model
- Findings register by severity, each mapped to a control
- Target reference architecture
Engagement arrangements
Dates, responsibilities and any ongoing review cadence are agreed in the written scope. Retesting is included where stated in that scope.
What happens after the scoping call
Written scope and fixed-fee proposal within one business day of your scoping call. The scope names the standards applied, the deliverables, the dates and the people doing the work.
Questions
Does this include testing?+
No. This is a design review. Penetration testing can be scoped alongside it as a separate engagement, and AI threat modelling covers the AI-specific design risks.
How is the fee set?+
The written proposal defines the fixed fee, responsibilities and deliverables. Any change to scope is agreed in writing before additional work begins. Ongoing advisory includes an agreed review cadence and availability.
How is our evidence handled?+
Evidence is held under NDA, encrypted at rest and in transit, restricted to the named engagement team and destroyed on the schedule stated in the scope. It is never used to train any model.
Tell us what changed.
Thirty minutes, no obligation. Written scope and fixed-fee proposal within one business day of your scoping call.
Book a Strategic AI Readiness Assessment