Offensive
Offensive Security
Controlled testing that shows where an attacker could gain access and what they could reach.
- Web application penetration testing
- API security testing
- Infrastructure penetration testing
- Cloud penetration testing
Independent cybersecurity consultancy
Security that holds up when tested.
We test the applications, APIs, cloud environments and infrastructure you rely on. When we find a weakness, we show your team how we got there, what it affects, and how to fix it.
- Offensive Security
- Defensive Security
- Security Engineering
- GRC
- Security Awareness
Security expertise across the attack surface
ApplicationsAPIsCloudNetworksIdentityPeopleDetection & LoggingGovernance
The problem
Most of the attack surface sits behind the controls meant to protect it.
A firewall or WAF inspects traffic on its way in. It cannot tell whether the application behind it checks that the account you asked for is an account you own.
Authentication flows, object-level authorization, business logic, third-party integrations, cloud identity and the application code itself each introduce weaknesses that a perimeter control is not positioned to see. Those are the weaknesses worth finding, because they are the ones an attacker can still reach.
Our work is deciding which of them are genuinely reachable, what they lead to when chained, and what it takes to close them.
What we do
Engagements organised the way you buy security.
Six service areas. Pick what you need, and we’ll scope the work around it.
Defensive
Defensive Security
Engineering and advisory support that builds the detection, logging and response capability your team runs.
- Security monitoring architecture
- Detection engineering
- Incident readiness
- Infrastructure hardening
- Vulnerability management
Engineering
Security Engineering
Application and cloud security built into the way engineering teams design and ship software.
- Secure software development
- DevSecOps
- Security architecture
- Cloud security engineering
GRC
Governance, Risk & Compliance
Turn security requirements into practical, measurable controls leadership and auditors can rely on.
- Security assessments
- Risk management
- Governance, risk & compliance
- ISO 27001 readiness
- Security policies & controls
Awareness
Security Awareness
Build a security-conscious workforce that can recognise, resist, and report common threats.
- Security awareness training
Not sure which?
Describe the system, not the service.
Tell us what you are building, changing, or worried about. We will say which engagement fits — including when the answer is that you do not need one yet.
Talk to an engineerEvidence
What our output actually looks like.
A few examples of how we work, from documenting a finding, to tracing the attack path, to putting it into a clear report. No client work is shown.
Web application · exampleHigh
IDOR / Broken Object Level Authorization
Affected endpoint: /api/accounts/{id}/
Attack scenario: An authenticated user changes the numeric account identifier in an API request and retrieves another user's account data without authorisation.
GET /api/accounts/4821/profileHTTP/1.1 200 OK{ "account_id": 4821, "owner": "other-user" }
Business impact: Any authenticated user could enumerate and access other customers' account data — a reportable data exposure.
Remediation: Enforce server-side object-level authorization for every requested resource.
Attack pathEntry → impact
01External user
02Public application
03Authentication weakness
04API access
05Privilege escalation
06Sensitive resource
Weaknesses become meaningful when they combine. We report the sequence, not just the individual issue.
Findings04
High01
RetestOpen
Leadership gets a prioritised view of risk; engineering gets the path to the fix.
ScopeExternal web application
Top findingBroken Object Level Authorization
Affected asset
/api/accounts/{id}/RemediationServer-side object authorization
Also available on request
Client engagements are confidential, so these are technical demonstrations of how we work rather than case studies.
- Sample Penetration TestA structured example of how a web application engagement is scoped, tested, and reported.
- Sample Vulnerability ReportA finding written the way your engineers would actually receive it — evidence, impact, and fix.
- Attack-Path AnalysisA demonstration of how isolated weaknesses are chained into a realistic attack sequence.
- Security Architecture AssessmentAn example of how we assess trust boundaries, identity, and data flow in a system design.
- Secure Coding ExampleA before/after example of a vulnerable code pattern and its secure implementation.
- Detection Engineering ExampleAn example detection rule mapped to a specific attack technique and its intended trigger.
Why O&D Cyber
An approach that's hard to copy.
Anyone can claim to be attack-minded or evidence-driven. Here is what that actually means when we work.
Explore our approach- 01
Attack-minded
We don't stop at identifying a theoretical weakness. We determine whether it can be chained into a meaningful attack path.
- 02
Evidence-driven
Findings include reproducible technical evidence, severity, business impact, remediation guidance, and retest status.
- 03
Engineering-focused
Recommendations should be implementable by the engineers responsible for fixing the problem.
- 04
Business-aware
Technical severity is translated into the operational and business consequences that matter to decision-makers.
What an engagement produces
Penetration Testing
- Executive summary
- Technical findings
- Severity ratings
- Proof of exploitation
- Attack-path analysis
- Remediation guidance
- Retest / validation
Security Assessments
- Current-state assessment
- Risk findings
- Prioritised recommendations
- Security roadmap
- Executive summary
GRC Engagements
- Gap assessment
- Risk register
- Control mapping
- Policy recommendations
- Remediation roadmap
How an engagement works
A clear process, from first conversation to retest.
01
Discovery
We understand your environment, objectives, scope, and risk concerns.
02
Assessment
We test the agreed attack surface using a structured methodology.
03
Evidence
We validate findings and determine practical exploitability and impact.
04
Reporting
You receive technical findings and an executive-level summary.
05
Remediation
We provide prioritised, implementable remediation guidance.
06
Retest
Where included, we validate that identified issues have been addressed.
Start with clarity
Ready to see what holds up?
No surprises between scoping and the final report. Describe the system, the requirement, or the uncertainty you want examined — we'll review the context and come back with the scope we think fits.
- 01
You describe the system, the requirement, or the uncertainty.
- 02
We review the context and come back with the scope we think fits.
- 03
If that turns out to be nothing at all, we tell you that instead.