// 04 · Service catalogue
What I do for clients.
7 service lines · EU regulated sectors
Seven practices, deliberately separated. Under Article 7 of Commission Delegated Regulation (EU) 2025/1190, threat intelligence and red team roles on a single TLPT must be staffed separately, with no reporting line between them, so these lines are scoped as distinct engagements rather than bundled. Pick a starting point and we'll scope from there.
01
/ TLPT
// DORA · Threat-led penetration testing
DORA TLPT
Threat-led penetration testing under Articles 26 and 27 of Regulation (EU) 2022/2554 (DORA), delivered against the TIBER-EU framework (European Central Bank), updated to align with the DORA TLPT RTS. The outcome is a supervisory attestation, not a conventional findings report.
What TLPT is
A live, intelligence-led red team test against an entity's production systems, run to a regulator-recognised methodology rather than a vendor-defined one. Scope, threat scenarios and control-team governance are agreed with the entity's TLPT authority before testing begins.
Three-phase structure
TIBER-EU runs the test through three phases, gated by the entity's control team: preparation, testing (split into threat intelligence, then the red team test), and closure, which folds in the Article 7 restoration obligations.
The deliverable
Not a findings report to be filed away. A TLPT concludes with a closure process feeding a supervisory attestation of the test having been conducted to the required standard: the artefact your TLPT authority and regulator actually rely on.
Provider requirements & phase mapping →
02
/ OFFSEC
// Adversary simulation
Offensive Security
If your defences haven't been pressure-tested by someone thinking like an attacker, they haven't been tested. Web, mobile, network, cloud: pick a perimeter.
Penetration Testing
Identify exploitable vulnerabilities in web, mobile, network, and cloud systems. OWASP-aligned testing methodology (WSTG for web, MASTG for mobile), fully documented findings, prioritised remediation plan. Delivered by a CEH Master-certified practitioner.
Red Team Exercises
Simulate real-world attackers to test the resilience of people, processes, and technology in a coordinated, multi-vector engagement.
OSINT Reconnaissance
Map your organisation's digital footprint to expose what's already visible to criminals: credentials, exposed services, social engineering hooks.
Phishing & Social Engineering
Evaluate employee resilience against the attack vectors that actually land: phishing, vishing, pretexting, USB drops.
03
/ DEFSEC
// Posture & readiness
Defensive & posture reviews
The opposite end of the table. Assess your alignment against the frameworks regulators and clients actually ask about, and harden the configurations that matter.
Security Posture Reviews
Assess alignment with NIST CSF, ISO/IEC 27001, CIS benchmarks, and ENISA guidance, with a gap analysis your board can sign off on.
Cloud & SaaS Security Audits
Harden Azure, AWS, GCP and Microsoft 365 environments against the misconfigurations that cause most real-world breaches.
Incident Readiness
Tabletop simulations and playbooks to prepare your teams for the day something does land, before it does.
04
/ PRIV
// Data privacy & compliance
Privacy & Protection
EU data protection regulation as the primary focus. UCT-certified in Data Privacy & Protection. The unsexy work that keeps your fines off the front page.
GDPR Readiness Assessments
End-to-end review of your compliance posture against EU data protection regulations: DPIAs, ROPAs, lawful-basis mapping, subject-rights workflows.
Cross-border Compliance
Specialist support for businesses operating between EU and South African privacy landscapes (GDPR ↔ POPIA), or with mixed cloud-hosting geographies.
Data Classification & Governance
Implement sensitivity labels, records of processing, retention schedules and access policies, actually configured, not just documented.
05
/ INTEL
// Threat intelligence & monitoring
Threat intelligence
Know what's coming before it arrives. Dark-web monitoring and industry-specific threat landscape reporting your CISO can quote.
Dark Web Monitoring
Track leaked credentials, brand mentions, and sensitive data across underground forums and credential dumps.
Threat Landscape Reports
Industry-specific intelligence briefings to anticipate sector-relevant risks: quarterly, customised, board-ready.
06
/ TRAIN
// Awareness & enablement
Training & awareness
Humans are the most porous layer of every stack. Training that respects everyone's time, from the boardroom briefing to the developer secure-coding session.
Executive Briefings
Board-level updates on emerging cyber threats and regulatory obligations, translated out of vendor speak.
Cyber Awareness Workshops
Interactive training to reduce human risk across the wider organisation, designed for retention not just compliance ticks.
Developer & IT Training
Secure coding, system hardening, and threat-modelling sessions tuned to your stack and your team's seniority.
07
/ STRAT
// Strategic advisory
Strategy & vCISO
For organisations not yet ready for a full-time CISO, or that need senior cybersecurity leadership on retainer. The connective tissue between security, product and the rest of the business.
Cybersecurity Roadmaps
Build a security programme aligned to your business strategy: sequenced, budgeted, defensible to the board and auditors.
Virtual CISO (vCISO)
Interim or ongoing executive-level cybersecurity leadership. Monthly retainer, fractional hours, full ownership of the security posture.
ICT Third-Party Risk
Structured vendor assessments, contractual security baselines and register-of-information support aligned to DORA Chapter V's ICT third-party risk obligations, alongside broader supply-chain vulnerabilities for organisations outside DORA's scope.
// Engagement_models.txt
| Format |
Best for |
Duration |
Status |
| Targeted Engagement |
One-off pen test, GDPR readiness review, or architecture audit. |
2 – 6 weeks |
● Available |
| vCISO Retainer |
Fractional CISO leadership; monthly cadence, multi-quarter horizon. |
3 – 12 months |
● Available |
| Red Team Programme |
Repeatable adversary-simulation cadence with continuous reporting. |
Ongoing |
● Available |
| Workshop / Briefing |
Board briefings, exec tabletops, developer training sessions. |
1 – 3 days |
● Available |
| Incident Support |
Forensic investigation, breach response, post-incident reporting. |
As needed |
● On-call |
Scoping a piece of work? Let's talk.
Initial calls are free. Most NDAs and statements of work close within a week.
Open a thread→