Cloud, security and AI engineering

We build and secure your cloud environments and AI agents.

For Australian teams that have to prove it to an auditor or a customer. Scoping takes 30 minutes.

Get an instant quote AI readiness review
Start here

Start with the thing that triggered this.

Most production AI and cloud failures are access failures, not code failures. Your agent calls tools nobody mapped.

Route on the event, not on the capability.
What happenedWhere to start
An agent got write access to a repository or a databaseAgent security review
A customer attached AI questions to the security questionnaireBuyer due diligence pack
The coding assistant rolled out faster than the controlsCoding agent control baseline
An auditor or a customer named a penetration testPenetration testing
A customer or partner will call your API directlyAPI penetration testing
Nobody has reviewed the cloud account the data sits inCloud security review
The business is moving between Google Workspace and Microsoft 365Workplace migration
An enterprise buyer wants the whole control set evidencedSOC 2 readiness
What you keep

The record, named.

  • Findings Register: what we found, with severity and effort per owner.
  • Architecture Decision Record: what was decided and why the alternative lost.
  • Evidence Index: what an auditor asks for, and where it lives.
  • Cost Ledger: what changed, what it saved and who owns it.
  • Agent Blast Radius Map: the worst single call and the worst chain.
  • Tool Permission Ledger: the scope a tool holds against the scope needed.

Each one is a file in your repository, not a slide. The agent review produces the last two.

The work behind each one

What we engineer, and the mechanism in each.

01

Cloud

Migrations that have a rollback plan, and bills that have an owner per line.

  • Dependency maps and cutover runbooks. No unverified failover.
  • Idle GPU nodes and zombie NAT gateways, found and removed.
  • Architecture and cost reviews before you commit budget.
02

Security testing and posture

We reproduce the exploit path with a second role or a second tenant. A scan export is a coverage list, not a test.

  • Two accounts per role, so tenant isolation is proved not assumed.
  • Wildcard IAM, unrotated access keys, open vector database ports.
  • Penetration testing scoped by asset and role.
04

Platforms

Pipelines where a deploy is one merge, and a rollback is one revert.

  • Hermetic CI/CD with provenance attestation.
  • Ephemeral preview environments per pull request.
05

Advisory

We will tell you in writing when the current design is fine and the migration is not worth it.

  • Decision records naming the trade-off and the operational risk.
  • No partner tier and no reseller margin behind any recommendation.
How we work

What is agreed before we get access.

  • Scoping call is 30 minutes, and the written scope follows within one business day.
  • We do not start until the environment matches the agreed scope.
  • Findings arrive with severity, effort and a named owner per line.
  • Retest of reported items is included, on an environment still matching scope.
Scope

What we will not bill you for.

If we cannot show you the code, the config or the reproduced path, we do not bill for it.

Each service page lists what its scope excludes before you have to ask. Penetration testing and the agent security review both name theirs.

FAQ

The six questions buyers ask before the scoping call.

Do you work inside our cloud accounts?

Yes. Work runs in your accounts under your identity controls. You can audit every change.

Who does the work?

The people who scope the engagement deliver it. There is no junior bench.

Do we own what you build?

Yes. Code, configuration and documentation live in your repositories. No proprietary layer, no lock-in.

Which clouds do you work with?

AWS, Azure and Google Cloud. We hold no partner arrangement with any of them.

How do engagements work commercially?

Fixed scope with a named outcome, or a block of senior time. Both agreed in writing first.

Can you help if we already have a team?

Yes. Most work is an independent review your own team then executes.

Tell us what happened.

A short note is enough.

Talk to us
Contact

Start a conversation.

Name, work email and a short message. Used only to reply.

What do you need?

We reply within one business day with a scoping call time or a written reason we are not the right fit.

A director reads every message. If the trigger does not match work we do, you get that in writing.

[email protected]

Last reviewed:

Instant quote

Get an instant quote in 2 minutes

Answer four questions. The indicative price updates as you go. Prices are ex GST.

Indicative until we confirm scope in writing, within one business day. We use your details only to reply. See our Privacy notice.