Practice 04
Cybersecurity & Compliance
We design and implement enterprise security architectures, compliance frameworks, and AI governance models that protect data, meet regulation, and withstand sophisticated threats — including risks introduced by autonomous agents, MCP integrations and AI-generated code paths.
Follow the architecture
Security is a system. Not a checkpoint.
Follow a request across five trust boundaries. Identity establishes who is asking; policy decides what is allowed; evidence makes the outcome accountable.
Caller — Establish context
A request arrives from a person, device or service. Start with its identity, device posture and the sensitivity of the requested operation—not an assumption that an internal network is safe.
- Identify the caller and tenant
- Classify the requested data
- Check device and session context
Identity — Authenticate
An identity provider verifies the caller. Authentication proves identity; it does not by itself authorise access to every application or record.
- Require MFA where appropriate
- Prefer short-lived credentials
- Separate human and workload identities
Policy — Decide access
The enforcement point evaluates identity, resource and context. Deny by default and check object-level permissions on every request, not just at login.
- Apply least-privilege permissions
- Validate inputs and rate limits
- Record the authorisation decision
Workload — Protect the data
The service performs only the authorised operation. Isolate secrets, restrict outbound connections and keep sensitive data protected in transit and at rest.
- Use managed secret storage
- Enforce tenant and data boundaries
- Constrain service-to-service access
Evidence — Detect & respond
Security events should reach people who can act on them. Correlate access and workload signals without logging unnecessary sensitive payloads.
- Redact and protect audit records
- Route alerts to accountable owners
- Exercise incident response and recovery
Hover, focus or tap a flow node to reveal the decisions behind it.
Architecture, explored
Security is a system. Not a checkpoint.
Design questions to resolve
Start with a boundary. Build the bigger picture.
These are illustrative patterns, not a description of a deployed client system or a guarantee of compliance. The right architecture depends on your constraints, risks and operating model.
From concept to implementation
Technical scope & design decisions
Explore the questions, techniques and potential outputs that can shape an engagement. Final scope depends on the requirements and evidence available.
01Zero Trust Architecture
Enterprise zero-trust security frameworks that eliminate implicit trust, enforce least-privilege access, and secure every interaction across users, devices, workloads, and data.
Design & implementation focus
- Zero trust maturity assessment and phased implementation roadmap
- Identity-centric access model replacing perimeter-based security
- Google BeyondCorp, Cloudflare Access and Zscaler ZTNA deployment
- Device trust and MDM integration with CrowdStrike and Intune
- Network microsegmentation with NSX-T and cloud security groups
- Application-layer access policies with session recording and anomaly detection
- Continuous verification with risk-adaptive authentication policies
- Zero trust audit trail, SIEM integration and compliance reporting
Potential engagement outputs
- Zero Trust Architecture
- Implementation Roadmap
- Policy Framework
- SIEM Integration
- Compliance Report
- Training Guide
02Identity & Access Management
Enterprise IAM architecture spanning cloud, hybrid and multi-cloud environments — delivering centralised identity governance, privileged access management, and federated authentication.
Design & implementation focus
- Identity governance: joiner-mover-leaver lifecycle automation
- Privileged access management with CyberArk, Delinea or AWS IAM Identity Center
- SSO federation with SAML 2.0 and OIDC across cloud and SaaS applications
- Attribute-based access control for fine-grained data and API authorisation
- Service account governance and machine identity management
- Cross-cloud IAM federation and role mapping across AWS, Azure and GCP
- Access certification campaigns and SoD conflict detection
- Passwordless and phishing-resistant MFA implementation
Potential engagement outputs
- IAM Architecture
- Access Model
- Policy Library
- PAM Implementation
- Federation Config
- Governance Runbook
03Cloud Security Architecture
Multi-cloud security architecture design and implementation — delivering defence-in-depth across network, compute, data, and identity layers with cloud-native controls.
Design & implementation focus
- Cloud Security Posture Management with Wiz, Prisma Cloud or Defender for Cloud
- Cloud Workload Protection Platform for runtime threat detection
- Encryption key management with AWS KMS, Azure Key Vault and GCP KMS
- Network security: WAF, DDoS protection, firewall rule governance
- Secrets management with HashiCorp Vault, AWS Secrets Manager and Key Vault
- Container security: image scanning, admission controllers and runtime protection
- Vulnerability management programme with cloud-native tooling integration
- Security as Code: automated security testing in CI/CD pipelines
Potential engagement outputs
- Security Architecture
- CSPM Configuration
- Key Management Design
- Network Security Rules
- Secrets Strategy
- Security Pipeline
04Threat Detection & SIEM
Enterprise threat detection and SIEM platforms that correlate signals across cloud, on-premises and SaaS environments — enabling rapid detection, investigation and response.
Design & implementation focus
- Microsoft Sentinel workspace design with data connectors and analytics rules
- Splunk Enterprise Security deployment and correlation rule development
- Google Chronicle and Mandiant for threat intelligence enrichment
- UEBA implementation for insider threat and anomalous behaviour detection
- SOAR playbook development with Sentinel Automation, Splunk SOAR and Cortex XSOAR
- Threat hunting programme with hypothesis-based detection engineering
- SOC operating model, triage workflows and escalation procedures
- Detection as Code with sigma rules, KQL and SPL rule libraries
Potential engagement outputs
- SIEM Architecture
- Detection Rules
- SOAR Playbooks
- Threat Model
- SOC Runbook
- KPI Dashboard
05Compliance & Regulatory Frameworks
Structured compliance programmes that map technical controls to regulatory requirements — delivering audit-ready postures across ISO 27001, SOC 2, GDPR, PCI-DSS and beyond.
Design & implementation focus
- ISO 27001 gap analysis, ISMS design and certification programme management
- SOC 2 Type II readiness assessment and continuous control monitoring
- GDPR data protection impact assessment (DPIA) and Article 30 records
- PCI-DSS scoping, control implementation and QSA audit readiness
- Cyber Essentials and Cyber Essentials Plus certification support
- NIST Cybersecurity Framework alignment and current-state gap analysis
- DORA readiness programme for financial services organisations
- Compliance automation with continuous control evidence collection
Potential engagement outputs
- Gap Analysis
- ISMS Documentation
- Control Matrix
- DPIA Reports
- Audit Evidence Pack
- Compliance Dashboard
06Data Privacy Engineering
Privacy-by-design engineering practices and technical controls that protect personal data throughout its lifecycle — from collection through processing to deletion.
Design & implementation focus
- Privacy by design review and data minimisation pattern implementation
- PII detection and classification with ML-powered scanning pipelines
- Tokenisation, pseudonymisation and differential privacy implementation
- Consent management platform integration and preference propagation
- Data Subject Access Request (DSAR) automation and fulfilment workflows
- Right-to-erasure implementation across data stores and backups
- Privacy-preserving ML: federated learning and synthetic data
- Data retention automation with policy-driven lifecycle management
Potential engagement outputs
- Privacy Architecture
- PII Classification
- Consent Platform
- DSAR Workflow
- Retention Automation
- Privacy Review Checklist
07Secure AI & Prompt Safety
Specialist security architecture for AI systems — addressing prompt injection, IDE/agent data exfiltration, model inversion, supply-chain risks in AI-generated code and the emerging threat landscape unique to LLMs and agentic AI.
Design & implementation focus
- AI-specific threat modelling using STRIDE and OWASP LLM Top 10
- Prompt injection detection and mitigation layer design
- Input sanitisation and output filtering for production LLM systems
- LLM firewall implementation with Guardrails AI and LakeraGuard
- Data exfiltration prevention for RAG systems with enterprise knowledge bases
- AI red-teaming and adversarial prompt testing programmes
- Model access control and API security for AI service exposure
- Agentic AI containment: sandbox environments and action approval workflows
Potential engagement outputs
- AI Threat Model
- Safety Controls
- Red Team Report
- LLM Firewall Config
- Guardrails Library
- Incident Response Plan
08Security Architecture Review
Independent security architecture reviews and threat modelling engagements — providing expert, unbiased assessment of proposed and existing system architectures.
Design & implementation focus
- System-level threat modelling with STRIDE, PASTA and attack tree methodologies
- Cloud architecture security review against CIS Benchmarks
- API and integration security review: authentication, authorisation and data exposure
- Third-party and supply chain security assessment
- Container and Kubernetes security review with CIS Kubernetes Benchmark
- Cryptographic design review: algorithm selection, key management and lifecycle
- Security peer review for regulated industries (financial services, healthcare)
- Remediation planning with risk-ranked recommendations and roadmap
Potential engagement outputs
- Threat Model
- Architecture Review Report
- Risk Register
- Remediation Roadmap
- Benchmark Assessment
- Executive Summary