Cyberange Services
Four practices, scoped for your organisation rather than sold as a package.
Each service below has its own page setting out scope, method, what you receive and the questions clients usually ask. If you are not sure which one your problem belongs to, that is a normal place to start — describe it on a call and we will tell you.
Testing & Offensive Security
Finding what an attacker would find, by hand, before somebody else does.
Penetration Testing
Finding the chain an attacker would use, across infrastructure, systems and networks.
- Infrastructure and internal networks
- Critical operating systems
- Web servers and databases
- Wireless and regulated products
Application & Mobile Security
Testing what your application lets people do that it should not.
- Web applications and interfaces
- Android and iOS
- Application-level database testing
- Secure development and code review
Social Engineering & Phishing
Controlled campaigns against your own people, measured on reporting rather than clicks.
- Pretexts built from open-source reconnaissance
- Credential and action lures
- Targeted campaigns for high-value access
- Staff debrief and programme advice
Architecture & Cloud
The design decisions that determine how far an intrusion travels, and the configurations that undo them.
Security Architecture Review
Reviewing the design against a threat model, at the point where it can still be changed cheaply.
- Trust boundaries and segmentation
- Identity architecture
- Data flow and detection by design
- Prioritised remediation roadmap
Cloud Security Assessment
How your cloud and SaaS estate is actually configured, and which findings chain into something real.
- Identity and entitlement analysis
- Configuration against hardening benchmarks
- Internet exposure and data storage
- Logging and detection coverage
Governance, Risk & Assurance
Controls that run, evidence that holds up, and obligations you can actually demonstrate you have met.
GRC, Risk & Compliance
Controls that run and evidence that holds up, not a folder of policies.
- Regulatory framework and risk register
- ISO preparation and training
- Incident response assessment
- Virtual CISO
IT & Security Audit
Independent testing of whether the controls you believe are running actually are.
- Control design and operating effectiveness
- Access, change and recovery controls
- Internal audit co-sourcing
- Audit readiness before assessment
Privacy & Data Protection
What personal information you hold, where it goes, and what Canadian law requires of you.
- PIPEDA, Quebec Law 25 and provincial PIPA
- Privacy impact assessments and data mapping
- Privacy Officer support
- Privacy by design with engineering teams
Response & Resilience
Deciding who does what, and proving it works, before the night it matters.
Capabilities that support an engagement
These are scoped as part of a wider programme or added to an existing engagement. If one of them is what you actually need, say so on the call and we will scope it directly.
Threat and vulnerability management
Threat analysis, vulnerability management and the process of deciding what to fix in which order — rather than a monthly list nobody works through.
Security technology advisory
Cloud security, endpoint protection, cyber asset inventory, secure data exchange and secure browsing, selected for your environment.
Detection and response advisory
Advising on your monitoring and detection capability: what should be logged, what should raise an alert, and whether your current arrangement would actually catch an intrusion. We advise on this capability; we do not operate a twenty-four hour security operations centre.
Third-party and vendor risk
Assessing the security of the suppliers you depend on, and the evidence you hold that their controls work.
Awareness and training
Staff awareness, and management and board sessions on what leadership is accountable for.
Scoped first, priced before we start
We do not publish packages or price lists. What an engagement costs depends on scope: how much estate is in it, how many environments, what you need to prove and to whom, and how much already exists.
So every engagement starts with a short call, followed by a written scope and a fixed price for that scope before any work begins.
Not sure which one you need?
That is a normal place to start. Describe the problem and we will tell you which practice it belongs to, and whether it is worth doing now or later.
Start with a scoping call
Thirty minutes, no obligation. We will tell you what is worth doing first and scope it properly before you commit to anything.
Contact Cyberange