Services · Consult
Security consulting
An independent view of your security weaknesses and a prioritised, practical plan to fix them.
Security advice often arrives as a long list of everything that could go wrong. We start with what you need to protect and who might want it, then review accounts, devices, networks, cloud settings and processes against that. The result is a short, ranked plan of defensive changes your team can complete. Any hands-on testing needs the system owner’s written permission.
What you get
- An inventory of critical systems and data stores, and who has access to each
- A threat model naming likely attackers, entry points and the impact of each
- A review of identity, device, network, cloud and backup controls against your risks
- A risk register ranking every finding by likelihood, impact and effort to fix
- A prioritised remediation plan with owners, and quick wins clearly marked
- Draft policies for access, passwords, devices and incident response
- A gap summary against a framework you choose, such as ISO 27001 or CIS Controls
How it works
- 01
Scope
We agree which systems, sites and teams are in scope, and record written authorisation before anything is examined.
- 02
Review
We inspect configurations, access lists, policies and logs, and interview the people who run the systems day to day.
- 03
Prioritise
Each weakness is rated by likelihood and impact, then grouped into quick wins, planned work and accepted risks.
- 04
Advise
You receive the plan, a walkthrough for your team and help answering security questions from customers or auditors.
Scope it now.
Answer a few questions and we prepare the email for you. Nothing is sent until you press send in your own email app.
Prefer to write freely? hello@clockborn.com
Questions
Do you test our systems by attacking them?
Only if you ask, and only with written permission from the owner of every system involved. Most consulting work is review and advice. Where hands-on testing is needed we scope it separately as a penetration test with agreed rules of engagement.
Can you get us certified?
We can assess your gaps against a standard such as ISO 27001, write the policies and controls, and help prepare evidence. Certification itself is issued by an accredited body after its own audit, so we help you get ready rather than certify you.
We are a small company. Is this overkill?
Attackers rarely check company size first, and small teams often have the thinnest defences. For a small team the review is shorter and the plan focuses on a few high-value controls: multi-factor sign-in, backups, device updates and email protection.