AI Engineering | Cyber Security
Twenty-five years of military and security operations, applied to the way businesses actually get breached today — through the tools nobody audited, the supplier nobody checked, and the information you've published without realising.
Start a conversation What we doThe difference
Both matter. Only one of them is what an attacker is doing.
Is everything up? Are the backups running? Is the firewall configured? Sensible questions, asked from the inside, by people whose job is continuity.
If I wanted into this business, where would I start? What have they published? Who would I target first? Which supplier is the soft route in? Asked from the outside, by someone whose career was spent thinking that way.
What we do
Assessment first. No business needs a solution to a problem nobody has confirmed it has.
What can be learned about your business from openly published sources — your site, job adverts, filings, your people. This is where an attacker starts, so it's where we start.
Internal and endpoint review. Where the gaps actually are, ranked by what a real attacker would reach for first rather than by a generic severity score.
The newest and least examined surface in most businesses. AI tools, connectors and browser extensions adopted by staff without review — each one a route in that nobody signed off.
What happens when something fails. Single points of failure, recovery that has never been tested, backups that exist in one place only.
Method, not marketing
Rather than describe this in the abstract, here is the sequence an exposure assessment follows, and the kind of thing it turns up. No client is named anywhere on this site, and none will be without their written agreement.
Your website, your filings at Companies House, your job adverts, your tender documents, your PDFs, your subdomains and your certificate records. Everything an attacker can read without touching your network.
Commonly found: a staging site still reachable with live data on it; an old job advert naming your exact firewall, VPN and finance system; document metadata exposing internal usernames and server paths.
Who holds authority over payments, systems and suppliers, how they are addressed internally, and how much of that is visible from outside. This is the groundwork for every invoice fraud and impersonation attempt.
Commonly found: a predictable email format plus a public org chart — enough to write a convincing instruction from a director to a bookkeeper; personal social accounts confirming who is away and when.
Whether your domain's accounts appear in known breach corpora, and whether anything reused from those breaches would still work today.
Commonly found: live accounts whose password was exposed years ago and never changed, often on a system nobody remembers is still running.
Which third parties hold your data or hold access into your systems, and which AI tools, connectors and browser extensions your staff have adopted without anyone reviewing what they can reach.
Commonly found: an AI assistant granted standing access to a whole mailbox or drive; a former supplier's account still active months after the contract ended.
Email authentication, exposed services, the resilience of your domain and mail configuration. Confirmed from the outside, non-intrusively, and only within the scope you have agreed in writing.
Commonly found: SPF, DKIM or DMARC incomplete, meaning anyone can send mail that appears to come from your own domain.
A written report ranked by what a real attacker would reach for first, not by a generic severity score. Each finding has the evidence attached, the realistic consequence, and a fix you can action or hand to your IT provider.
What you get: the report, a walkthrough of it, and a plain list of what to do first. If the honest answer is that your exposure is low, that is what the report will say.
How this is priced
No day rates that drift, no open-ended retainer as the opening offer, and no invoice you could not have predicted. The scope and the fee are written down and signed off before any work begins.
A single fixed fee, quoted after a fifteen-minute conversation about the size and shape of your business. You know the number before you commit.
Quoted separately, per piece of work, once the assessment has established there is something to fix. Priced as a fixed piece of work wherever the scope allows it.
A periodic re-check for businesses that change often. Offered only where it is genuinely useful, and never as a condition of the first piece of work.
Fifteen minutes to establish whether there is anything worth doing. No fee, and no obligation to go further.
Scoping the work and putting a fixed figure in writing costs you nothing, whether or not you go ahead with it.
If the assessment finds your exposure is low, that is the finding. You will not be sold work to justify the engagement.
No lock-in, no auto-renewal, and no work started before you have seen the number and agreed to it in writing.
Who this is for
No IT function, work happening on personal devices, customer data moving through WhatsApp and email. Rarely attacked deliberately — frequently caught in something automated.
Dozens of tools nobody has audited, staff adopting AI services without review, compliance obligations arriving through contracts. Enough to lose that it's worth someone's time.
Who you're dealing with
Twenty-five years in military and security operations management. Reading a threat, anticipating an adversary, and keeping an operation running when it starts to come apart — that was the job, long before it was a product category.
You're not just getting someone who understands the technology. You're getting someone who understands the threat.
That background is paired with current work in AI and cybersecurity, because the surface has changed even though the thinking hasn't. Where a piece of work needs a specialist, Tier 1 Elite brings one in rather than pretending otherwise.
Straight answers
Most IT companies focus on keeping your systems running, which is a real and necessary job. We come at it from the other direction — how would someone get in? That's a different discipline, built over twenty-five years of thinking about adversaries rather than uptime.
Usually not personally, and that's the misunderstanding. Most small businesses are caught by something automated that found an opening and took it. Nobody chose you. That doesn't make the consequences smaller.
It's a fair question and the honest answer is that it cuts both ways. What that background gives you is threat thinking and operational judgement under pressure, which is the part most technical people never learn. Where deep technical specialism is needed, it's brought in — named and verifiable, not implied.
Then you'll be told so, and told when you'll get an answer. This field moves weekly and nobody is current on all of it. Anyone who claims otherwise is either not paying attention or not being straight with you.
A conversation, then an assessment. Nothing is recommended, sold or installed before there's evidence of what the actual exposure is.
Get in touch
Fifteen minutes to work out whether there's anything here worth pursuing. No obligation and no pitch — if there's nothing to do, you'll be told that.
Or email directly: [email protected]