SaaS security notes for founders and CTOs

What we’d check first, and what to ask any provider. For founders and the engineers who do the work.

Free 30-minute call. We reply within one working day.

API authorisation: where one customer sees another’s data

Permission checks tend to hold on the main screens and slip on the export or the overnight job.

Application & API

Architecture review or penetration test first?
The answer depends less on your product than on what is about to change in it.
SaaS architecture
Cloud security assessment: agree access before anyone logs in
What to agree about accounts and access before a cloud assessment starts, so the report covers what you think it covers.
Cloud security
CI/CD security: who can ship to production unseen?
Pipeline risk often comes down to an account or key that can reach production without a second person seeing the change.
Code delivery & developer access
Prompt injection testing for RAG and AI agents
What to test in an AI feature that reads customer documents or calls tools, and what to ask whoever tests it.
AI & agent security
Microsoft 365 and Google Workspace: start with the admins
The questions we’d put to whoever runs your admin console, starting with who holds admin rights.
Company IT security
Closing VAPT findings before the retest
Short answers to the questions owners ask in the weeks between a VAPT report and the retest.
VAPT report remediation

Tell us what’s changing in your product. On a free 30-minute call we’ll suggest what to check first.

We reply within one working day. We set up the call, and you meet the people who’d do the work.
We send a proposal with the scope, the timing and a fixed fee.
Work starts when you say go.