Cyber security and technology

Test it, teach it, track it

Security testing and staff training from the same team that advises on governance. Findings are tied to risk, so fixes are owned, tracked and checked.

Request a scoping call See training courses

What we offer

Three services, one connected programme

Ethical hacking

Authorised, controlled attempts to break into your systems, so you learn how an attacker would move before one does.

What you get

Web and mobile application testing
Network and internal infrastructure testing
Written report with reproduction steps and fix guidance
Retest of fixed issues

Who it suits

Organisations with customer-facing systems, online payments or sensitive data.

How it runs

Scope is agreed in writing first. Testing runs in a window you approve, with a named contact on call.

Vulnerability assessment

Regular scanning and expert review to find known weaknesses before they are exploited.

What you get

Scheduled scans of agreed systems
Prioritised list of issues by severity
Remediation tracking against your risk register
Trend reports for the board

Who it suits

Organisations that need ongoing assurance, or evidence for audit and regulators.

How it runs

A monthly or quarterly cycle, set up during scoping. Results feed the same tracker each time.

Awareness training

Short, practical sessions that change everyday behaviour. People are the most common route in.

What you get

Sessions of 30 to 60 minutes
Phishing simulations, with reporting
Completion records for audit
Refreshers each year

Who it suits

Every staff member, from front desk to board.

How it runs

Delivered at your site, online, or in an open cohort. Completion is recorded in the CRCI platform.

How an engagement works

Four steps from scope to fix

Scope and rules

We agree the systems in scope, the testing window and the rules of engagement in writing before any testing starts.

Test or assess

Ethical hacking uses controlled, authorised methods. Vulnerability assessments use scheduled scans and manual review.

Report and prioritise

Findings are rated by severity and business impact. Board members get a short executive summary; technical teams get the detail.

Fix, retest and train

We agree a remediation plan, retest the fixes and link open items to your risk register and staff training.

Awareness training

What staff learn

Modules can be combined into a course for your organisation, or delivered as short refreshers.

Phishing and social engineering

How to spot and report suspicious email, calls and messages.

Passwords and multi-factor authentication

Strong sign-in habits and why MFA matters.

Data handling and privacy

Your duties under the Cyber and Data Protection Act [Chapter 12:07].

Remote and mobile working

Securing laptops, phones and home networks.

Incident reporting

What to do in the first hour, and who to tell.

What you receive

Reports that boards and technical teams can both use

Every engagement ends with clear, usable outputs rather than a long document that nobody reads.

Executive summary for directors, in plain language, with the top risks and decisions needed.
Technical findings rated by severity, with evidence and fix steps.
Remediation plan with owners and dates, linked to your risk register.
Training records showing who completed what, ready for audit.

Coming soon

CRCI GRC platform

One workspace to manage risks, controls and compliance obligations, with the testing and training above feeding into it.

Risk register with owners, ratings and treatment plans
Controls library mapped to obligations
Compliance calendar and reminders
Evidence store for audit trails
Training and certificate tracking
Role-based access with multi-factor sign-in

Join the waitlist

Questions

Common questions

Do you test without permission?

No. Testing starts only after a signed scope and written authorisation from the system owner.

Who receives the results?

Board members receive an executive summary. Technical teams receive the full findings, with steps to reproduce and fix each issue.

Can training be delivered in-house?

Yes. Sessions can run at your site, online, or as a cohort open to several organisations. Dates and fees are confirmed per engagement.