Services
Security work that ends in a running control.
Assessment, engineering and support under one roof. We scope to the risk you actually carry, then stay long enough to implement and prove the fix.
Where to start
Most organisations do not need another list of vulnerabilities. They need a clear answer to three questions: what could materially go wrong, which obligation or commitment does it breach, and what is the smallest set of controls that changes the outcome?
Cybrera works across six connected services. You can engage one directly, or use them as a sequence — assess, prioritise, implement, assure. Every engagement begins with a written scope and, where testing is involved, written authorisation.
Virtual CISO
Senior security leadership without a full-time hire. A vCISO gives you a decision-maker who can translate business risk into a security programme, run the risk register, challenge vendors, prepare the board and keep incidents from becoming surprises.
- Security strategy, 90-day plan and quarterly roadmap
- Risk register, treatment decisions and board reporting
- Policy and standards that match how the business actually operates
- Vendor and third-party security review
- Incident readiness, tabletop exercises and post-incident review
DPDP compliance
Turn the DPDP Act 2023 into an operating programme. We map personal data, define lawful purposes, design notice and consent, operationalise data-principal rights, set retention and deletion, and prepare a breach response you can run under pressure.
- Data discovery and record of processing
- Notice, consent and purpose limitation design
- Access, correction, erasure and grievance workflows
- Retention, deletion and vendor governance
- Breach detection, notification readiness and evidence
Security audits & assurance
Know where you stand before a customer, auditor or regulator tells you. We assess the control environment against the framework that matters to you — ISO/IEC 27001, SOC 2, CIS Controls, contractual requirements or sector expectations — and give you a prioritised, evidence-based view.
- Gap assessment and readiness review
- Control design and operating-effectiveness testing
- Cloud configuration and identity review
- Third-party and vendor risk assessment
- Remediation plan with owners and sequencing
Penetration testing & VAPT
Adversarial testing with fixes your engineers can ship. Manual testing across web applications, APIs, mobile apps, networks and cloud environments, supported by tooling but not limited to it. Findings are rated by exploitability and business impact, with reproducible evidence and practical remediation guidance.
- Web, API, mobile, network and cloud penetration testing
- OWASP and PTES-aligned methodology, scoped to the target
- Rules of engagement, authorisation and safe-testing constraints
- Reproducible findings, evidence and remediation guidance
- Retesting to confirm the fix
Cloud security & hosting
AWS-first cloud security, hosting and engineering. We design and operate landing zones, identity and access boundaries, network segmentation, encryption, logging, backup and recovery — with cost and operational reality treated as design constraints, not afterthoughts.
- AWS landing zone and account structure
- IAM, least privilege and federation
- Network segmentation and private connectivity
- Encryption, key management and secrets handling
- Central logging, detection and backup/recovery
- Application hosting and secure deployment
Explore cloud security and hosting
Implementation, deployment & support
From recommendation to running control. Where you need hands-on help, we implement: harden the environment, codify it, deploy it, document it and support it. Handover includes runbooks and the evidence your team needs to operate the control without us.
- Security hardening and remediation delivery
- Infrastructure as code and repeatable deployment
- Monitoring, alerting and log pipelines
- Backup, recovery and continuity testing
- Operational runbooks, handover and support retainers
Explore implementation and support
How engagements start
- Scoping conversation. What you are protecting, what changed, what you need to prove.
- Written scope. Objectives, boundaries, deliverables, dependencies and assumptions.
- Authorisation. Signed rules of engagement before any testing begins.
- Delivery. Working sessions, evidence collection and progress reviews.
- Handover. Findings, priorities, runbooks and a clear next step.
We do not publish fixed packages for complex security work. Scope, access and risk vary too much for a meaningful fixed price. After a short conversation we will give you a written scope and a clear commercial proposal.