Industry

Technology, SaaS & Product

Security as a condition of the deal.

For software businesses, security is a commercial gate. Enterprise buyers ask for attestation reports, penetration test evidence and answers to two hundred questionnaire items before signing. Gryffin builds the security posture and the proof of it, without slowing the release cadence the business runs on.

Industry Challenges

What makes this industry different.

Deals gated on attestation and test evidence

SOC 2, ISO 27001 and a recent penetration test report are procurement requirements long before they are security requirements.

Multi-tenant isolation as an existential risk

A single authorisation flaw that crosses tenant boundaries is a company-level event, not a bug.

Security review as a release bottleneck

Manual pre-launch checks that find the same categories of issue every time slow delivery without reducing risk.

An API surface larger than the documentation

Legacy, internal and undocumented endpoints accumulate faster than anyone inventories them.

Where you sell into regulated buyers, their obligations become your contractual ones. We map customer security schedules to the control set so one programme satisfies the whole customer base.

Services

Services Most Used Here

Ready before the auditor arrives.

SOC 2 is an auditor's opinion on controls you operate, which means the work that determines the outcome happens long before fieldwork. Gryffin designs the control environment, instruments the evidence, and runs a readiness assessment that finds the exceptions while they are still cheap to fix - then supports you through the observation window and the auditor's fieldwork.

Services Description

What the engagement covers.

Criteria selection and scoping

Deciding which Trust Services Criteria apply - Security always, plus Availability, Confidentiality, Processing Integrity or Privacy where your commitments require them - and defining the system boundary.

Type I and Type II planning

Sequencing a Type I point-in-time report and the Type II observation window against your commercial deadlines.

Control design and remediation

Designing controls that satisfy the criteria and can be operated consistently, then closing the gaps found in readiness assessment.

Evidence architecture

Instrumenting systems so control evidence is generated and retained automatically through the observation window rather than reconstructed at the end of it.

Readiness assessment

A full dry run against the criteria, identifying every likely exception before the auditor's fieldwork begins.

Auditor selection and liaison

Support selecting a CPA firm, managing the request list, and responding to fieldwork queries.

What you receive

Scoping document and system description draft
Control matrix mapped to the Trust Services Criteria
Readiness assessment report with an exception list and remediation plan
Evidence collection design and retention schedule
Auditor request-list management through fieldwork
Post-report remediation plan for any exceptions noted

Gryffin Global Capabilities

Exceptions found early, while they are cheap

A control gap found in readiness costs a fix. The same gap found in fieldwork costs a qualified report and a conversation with your customers.

Evidence that accrues by itself

We instrument access reviews, change management, vulnerability closure and monitoring so the observation window produces its own evidence trail. Manual evidence collection is where Type II reports go wrong.

Mapped against ISO 27001 where you hold it

If you are certified or heading there, the control set is built once and mapped both ways, so the second framework is a mapping exercise rather than a second programme.

We do not audit our own work

Gryffin provides readiness and remediation; the attestation is issued by an independent CPA firm. We help you select one and manage the relationship, and we keep the roles cleanly separated.

Use Cases

Illustrative. Scenarios drawn from common engagement patterns.

Deals lost for want of a report

Situation: A SaaS business had lost two enterprise deals in a quarter with no attestation and no credible timeline.
What Gryffin does: Rapid readiness assessment, control remediation, evidence automation, and a Type I issued inside the sales cycle with the Type II window starting immediately.
Outcome: Type I in hand for the pipeline, Type II delivered on schedule.

An observation window with no evidence trail

Situation: An organisation reached the end of a Type II window to find several controls had no retained evidence of operation.
What Gryffin does: Evidence reconstruction where defensible, control redesign where not, and instrumentation for a re-run window.
Outcome: A clean report in the following cycle, with evidence generated automatically thereafter.

Certified to ISO 27001, now asked for SOC 2

Situation: A certified organisation faced US customers who wanted SOC 2 specifically.
What Gryffin does: Mapping of the existing ISMS control set to the Trust Services Criteria, gap closure on the differences only, and readiness assessment.
Outcome: SOC 2 readiness reached in a fraction of a standalone programme's effort.

A management system that works, not a folder of policies.

ISO 27001 certification fails in one of two ways: the organisation builds a documentation set nobody follows, or it builds real controls but cannot evidence them. Gryffin builds the management system as an operating reality - scoped tightly, instrumented so evidence accumulates on its own, and supported all the way through certification-body audit rather than handed over at the documentation stage.

Services Description

What the engagement covers.

Scoping and gap assessment

Definition of a defensible certification scope, followed by assessment against ISO/IEC 27001:2022 clauses and Annex A controls to establish exactly what exists and what is missing.

Risk assessment and treatment

A risk methodology your organisation can actually repeat, applied to produce a risk register, treatment plan and Statement of Applicability that reflect real decisions.

ISMS design and documentation

Policy set, procedures, records and management-system structure written for your organisation rather than lifted from a template pack.

Control implementation support

Hands-on support implementing the technical and organisational controls the risk treatment calls for, delivered with Gryffin's engineering teams where technical work is required.

Internal audit and management review

A full internal audit cycle and documented management review, closing findings before the certification body sees them.

Stage 1 and Stage 2 audit support

Certification-body selection, audit preparation, on-site support through both stages, and closure of any non-conformity raised.

What you receive

Gap assessment report with a prioritised remediation plan
Risk assessment methodology, risk register and treatment plan
Statement of Applicability with documented justifications
Complete ISMS documentation set, organisation-specific
Internal audit report and management review records
Certification-body liaison and audit-day support
Optional transition to a maintained managed service after certification

Gryffin Global Capabilities

We stay through the audit

Support does not end when the documentation is delivered. We are present for Stage 1 and Stage 2 and we own closure of any non-conformity raised.

Multi-standard mapping from day one

The control set is built so that SOC 2, ISO 27017, ISO 27018, ISO 22301, ISO 20000 and privacy obligations can be layered on later without a second programme. Evidence is collected once.

Engineering support included

When a control requires real technical work - logging, access review, encryption, segmentation - Gryffin's engineers implement it. Most consultancies write the requirement and leave you to find someone to build it.

Scope discipline

The single biggest driver of certification cost is scope. We design the tightest scope that still satisfies your customers and regulators, and we tell you where a wider scope buys you nothing.

Use Cases

Illustrative. Scenarios drawn from common engagement patterns.

Certification demanded by a customer, with a deadline attached

Situation: An IT services business was told by its largest client that certification was a condition of contract renewal nine months out.
What Gryffin does: Tight scope definition around the delivery environment, accelerated gap closure, ISMS build, internal audit, and certification-body scheduling aligned to the renewal date.
Outcome: Certified with two months to spare, on a scope the client accepted.

A previous consultant left a documentation pack and nothing else

Situation: An organisation held a full policy set that bore little relation to how it actually operated, and failed its Stage 1 readiness check.
What Gryffin does: Reconstruction of the ISMS around real processes, re-run of the risk assessment, evidence instrumentation, and a fresh internal audit cycle.
Outcome: Stage 2 passed with minor non-conformities only, and a management system the team could actually run.

Certified, but dreading every surveillance audit

Situation: A certified organisation rebuilt its evidence pack manually before each surveillance audit, consuming weeks of senior time.
What Gryffin does: Evidence automation across access reviews, change records, training and supplier assessment, plus a maintained internal audit calendar.
Outcome: Surveillance preparation reduced from weeks to days, with evidence accumulating continuously.

Attack it properly, or find out the hard way.

A penetration test is only worth what its findings are worth. Automated scanning tells you which software versions are old; it does not tell you that a low-privilege user can read another customer's records by changing one identifier. Gryffin's testing combines tooling for coverage with manual, business-logic-aware testing for the findings that actually matter - then reports them in a form your engineers can act on the same week.

Services Description

What the engagement covers.

External infrastructure testing

Internet-facing assets, exposed services, misconfiguration, weak transport security and credential exposure - assessed the way an unauthenticated attacker would approach them.

Internal network testing

Assumed-breach testing from inside the network: privilege escalation, lateral movement, Active Directory attack paths, credential harvesting and access to crown-jewel systems.

Web application testing

Manual testing against the OWASP ASVS covering authorisation, session handling, injection, business-logic abuse and multi-tenant isolation, on top of automated coverage.

Mobile application testing

iOS and Android assessment across client-side storage, transport security, platform misuse, anti-tampering, and the backend APIs the app depends on, aligned to OWASP MASVS.

API testing

REST, GraphQL and service-to-service interfaces assessed against the OWASP API Top 10 - broken object-level authorisation, excessive data exposure, rate-limit bypass, token and key handling.

Cloud configuration review

Authenticated review of cloud accounts covering identity policy, network exposure, storage permissions, logging and key management.

What you receive

Executive summary written for a non-technical reader, with an overall risk position
Technical findings with reproduction steps, evidence and affected components
Risk rating by exploitability and business impact, not scanner severity alone
Specific, implementable remediation guidance per finding
Remediation walkthrough session with your engineering team
Free retest of remediated findings and an updated clean report
Attestation letter suitable for customers, auditors and insurers

Gryffin Global Capabilities

Certified testers, recognised methodology

Testing follows PTES, OWASP ASVS, MASVS and the API Top 10, mapped to MITRE ATT&CK, delivered by testers holding OSCP, CREST and equivalent credentials - so the report holds up in customer security reviews and regulatory scrutiny.

Manual depth where it counts

Roughly the majority of the findings we consider high severity come from manual testing of authorisation and business logic. Those are the flaws no scanner reports and no attacker ignores.

Retest included, not sold separately

Remediation verification is part of the engagement. You get an updated report showing findings closed, which is usually what the customer or auditor actually asked for.

Production-safe rules of engagement

Scope, timing, rate limits, prohibited actions and abort conditions are agreed and signed before testing begins, with a named contact reachable throughout.

Use Cases

Illustrative. Scenarios drawn from common engagement patterns.

An enterprise deal blocked on a security questionnaire

Situation: A software vendor's largest prospect required an independent penetration test report dated within twelve months before contract.
What Gryffin does: Scoped external and application test with an executive summary written for the buyer's security team, plus retest after remediation.
Outcome: Report accepted by the buyer, high-severity findings closed in under three weeks, deal signed.

A payments feature about to go live

Situation: A fintech was releasing a new money-movement flow with authorisation logic that had never been independently reviewed.
What Gryffin does: Targeted application and API testing focused on authorisation and business logic, supported by source code review of the transaction path.
Outcome: Two flaws found that would have allowed transaction manipulation, both remediated before release.

An annual test that keeps finding the same things

Situation: A group had tested annually for years and kept receiving near-identical reports, suggesting remediation was not reaching root cause.
What Gryffin does: Testing plus a root-cause review of recurring finding classes, feeding into secure development standards and pipeline scanning.
Outcome: Repeat finding categories dropped away over the following two cycles as the underlying practices changed.

Secure the software you actually ship.

Application security works when it arrives as engineering work rather than as a late objection. Gryffin builds enterprise software as core business, which shapes how we secure it: threat modelling before code, protection at the edge for what is already running, and testing wired into the pipeline at thresholds that block real risk without blocking releases.

Services Description

What the engagement covers.

Threat modelling and secure design

Structured threat modelling on new and changing systems, producing security requirements that enter the backlog as engineering work.

API discovery and inventory

Finding the real API surface - including undocumented, legacy and shadow endpoints - before anything is protected, because you cannot defend what is not on the list.

API gateway protection

Schema enforcement, authentication and authorisation controls, rate limiting and abuse monitoring implemented at the gateway.

WAF and bot management

Web application firewall deployment and rule tuning, plus bot mitigation separating credential stuffing, scraping and inventory abuse from legitimate traffic.

DevSecOps pipeline integration

SAST, DAST, software composition analysis and secret scanning wired into CI/CD with gates calibrated to your risk appetite and release cadence.

Secure development enablement

Coding standards, secure component libraries and developer training targeted at the vulnerability classes your codebase actually produces.

What you receive

Threat models with prioritised security requirements
API inventory including previously undocumented endpoints
Gateway protection policy and WAF rule set, tuned against real traffic
Pipeline scanning configuration with documented gate thresholds
Secure coding standard and component guidance for your stack
Developer enablement sessions based on findings from your own code

Gryffin Global Capabilities

Built by people who ship software

Gryffin delivers custom applications, enterprise systems and APIs. Security controls are designed by engineers who have operated the same kinds of systems, which is why they survive contact with a delivery team.

Gates calibrated to ship

A pipeline that fails builds on low-severity findings gets bypassed within a month. We tune thresholds so the gate blocks what matters and stays trusted.

Discovery before protection

Most API exposure is on endpoints nobody remembered. Inventory comes first, every time.

Findings taught back to the team

Enablement sessions are built from vulnerabilities found in your own codebase, not from generic material. Developers fix classes of bug rather than instances.

Use Cases

Illustrative. Scenarios drawn from common engagement patterns.

Credential stuffing that looked like normal traffic

Situation: A consumer platform saw account takeovers with no infrastructure alerts, because the attack resembled ordinary login volume.
What Gryffin does: Bot management with behavioural fingerprinting, WAF tuning on login and checkout paths, and rate control at the API gateway.
Outcome: Automated login abuse suppressed with no added friction for genuine users, and takeover reports falling sharply.

A manual security review before every release

Situation: An engineering team lost days per release to a pre-launch check that found the same issue categories repeatedly.
What Gryffin does: Pipeline scanning, secure coding standards, developer enablement, and a risk-based gate replacing the manual review.
Outcome: Release cadence restored, with issues surfaced at commit time instead of at the gate.

An API surface larger than anyone believed

Situation: A platform's documented API was a fraction of what was actually reachable, including legacy endpoints from retired products.
What Gryffin does: API discovery across gateways, hosts and traffic, followed by decommissioning, schema enforcement and authorisation controls.
Outcome: Undocumented endpoints retired or brought under policy, and the remaining surface monitored.

One control model, whichever cloud they chose.

Cloud environments do not drift because engineers are careless; they drift because change is fast and guardrails are absent. Gryffin establishes a control model that applies across every account and every provider, deploys posture management that catches drift as it happens, and routes findings to the people who can actually fix them.

Services Description

What the engagement covers.

Posture assessment across accounts

Assessment of every account and subscription against CIS benchmarks and your own policy - identity, network exposure, storage permissions, encryption, logging and key management.

Landing zone and guardrails

Account structure, preventive guardrails, baseline logging and identity design so new environments start compliant rather than being remediated later.

CSPM deployment and integration

Continuous posture monitoring with drift detection, severity-based routing to owners, and integration with your ticketing so findings enter existing workflows.

Workload, container and Kubernetes security

Image scanning, admission control, runtime protection and workload identity for what runs inside the cluster, not just the account around it.

Cloud access and data protection

CASB and DLP for sanctioned and unsanctioned cloud application use, with classification driving policy on what may leave.

Multi-cloud consistency

One control model applied across AWS, Azure, Google Cloud and private infrastructure, with divergence documented where a platform genuinely differs.

What you receive

Posture assessment report by account with prioritised findings
Cloud security reference architecture and guardrail policy set
CSPM deployment with ownership routing and ticketing integration
Container and workload security standard
Data classification and cloud DLP policy
Remediation plan with owners and target dates, tracked to closure

Gryffin Global Capabilities

We build on these platforms already

Gryffin delivers cloud application development and enterprise workloads as core business. Cloud security recommendations come from people who have run production on the same services.

Findings that reach an owner

A posture tool that reports to nobody changes nothing. We map accounts and workloads to owning teams and route findings into the ticketing system they already use.

Preventive before detective

Guardrails that stop a misconfiguration being created are worth more than alerts about it afterwards. We push controls left into the landing zone and the pipeline wherever the platform allows.

Consistent across providers

Posture, identity, logging and workload controls are defined once and applied everywhere, so security does not depend on which platform a team happened to pick.

Use Cases

Illustrative. Scenarios drawn from common engagement patterns.

Accounts multiplying faster than governance

Situation: A scale-up had dozens of accounts across two providers, no consistent guardrails and no owner for misconfiguration.
What Gryffin does: CSPM across all accounts, landing zone guardrails, prioritised remediation of critical exposures, and ownership mapping.
Outcome: Public exposure of storage and management interfaces eliminated, with drift caught and routed automatically.

A storage bucket found by someone else

Situation: An external researcher reported a publicly readable bucket containing customer documents.
What Gryffin does: Immediate remediation, estate-wide exposure sweep, preventive guardrails blocking public access, and continuous detection for recurrence.
Outcome: Exposure closed, recurrence prevented at the policy layer rather than by vigilance.

Kubernetes in production with no controls

Situation: Clusters ran unscanned images with permissive service accounts and no runtime visibility.
What Gryffin does: Image scanning in the pipeline, admission control policy, workload identity, and runtime protection deployment.
Outcome: Vulnerable images blocked at admission, and runtime activity visible for the first time.

Find out whether anyone would notice.

A penetration test asks whether a system can be broken. A red team exercise asks a harder question: if a capable adversary went after your organisation for a month, would anyone notice, and would the response work? Gryffin runs objective-based adversary simulation against live defences, then re-runs it collaboratively so your detection team improves while the exercise is still on.

Services Description

What the engagement covers.

Objective-based red teaming

Full-scope simulation against agreed objectives - reaching a crown-jewel system, exfiltrating a marked dataset, achieving domain dominance - using the techniques a real adversary would.

Initial access simulation

Phishing, exposed services, credential reuse and where authorised, physical and social engineering vectors, agreed in the rules of engagement.

Blue team assessment

Independent evaluation of detection and response capability: what was seen, what was missed, how long triage took, and where the process broke.

Purple team exercises

Collaborative execution with your defenders in the room, running techniques deliberately so detections can be built and validated live.

ATT&CK coverage mapping

Every technique executed mapped against MITRE ATT&CK with detection outcome recorded - detected, alerted, missed.

Detection engineering handover

New and improved detection content developed during the exercise, handed over tested.

What you receive

Rules of engagement and objectives agreed in writing
Attack narrative with a full timeline of actions taken
ATT&CK coverage matrix showing detection outcome per technique
Detection and response capability assessment with gap analysis
Detection content developed and validated during the exercise
Executive debrief and technical replay workshop

Gryffin Global Capabilities

Objectives, not a vulnerability list

The exercise is judged on whether objectives were reached and whether they were noticed. That is the question leadership actually asked, and it is not the same question a penetration test answers.

Coverage measured against ATT&CK

Every technique is recorded with its detection outcome, producing a defensible measurement of capability rather than an impression of it.

Purple by default at the end

Even on a full-scope engagement, we finish with a collaborative replay so the defenders see exactly what happened and build detections while the detail is fresh.

Strict, written rules of engagement

Objectives, prohibited actions, escalation contacts and abort conditions are agreed and signed. A red team engagement that surprises your leadership has failed regardless of what it found.

Use Cases

Illustrative. Scenarios drawn from common engagement patterns.

Heavy investment in detection, never tested

Situation: A bank had spent significantly on tooling but had never verified whether an intrusion would be caught.
What Gryffin does: Full-scope red team against live defences, followed by a purple team replay with the detection team.
Outcome: Coverage measured against ATT&CK, with new detections built and validated during the exercise itself.

Response plan that had never met an incident

Situation: An incident response plan existed on paper but had never been exercised under realistic conditions.
What Gryffin does: Red team exercise run without warning to the operational team, with response performance observed end to end.
Outcome: Three process failures identified - escalation, authority and communications - and corrected before a real incident found them.

A board asking how good the security team really is

Situation: Leadership wanted an independent read on capability rather than a self-assessment.
What Gryffin does: Objective-based exercise with an executive debrief translating technical outcomes into capability and risk terms.
Outcome: An evidence-based capability picture for the board, and a funded improvement plan drawn from it.

Questions

Frequently asked

Talk to us about Technology, SaaS & Product

Tell us the obligation, the incident or the deadline driving the conversation - the first conversation is a scoping call, not a pitch.

We respond within 12 hours

Technology, SaaS & Product

Security as a condition of the deal.

Technology, SaaS & Product

What makes this industry different.

Services Most Used Here

Services Description

Gryffin Global Capabilities

Use Cases

Services Description

Gryffin Global Capabilities

Use Cases

Services Description

Gryffin Global Capabilities

Use Cases

Services Description

Gryffin Global Capabilities

Use Cases

Services Description

Gryffin Global Capabilities

Use Cases

Services Description

Gryffin Global Capabilities

Use Cases

Frequently asked

How quickly can Gryffin start an engagement?

Do you work with our existing security tooling?

What is the difference between a penetration test and a red team exercise?

Can you help us achieve certification, or only prepare for it?

Talk to us about Technology, SaaS & Product

Technology, SaaS & Product

What makes this industry different.

Services Most Used Here

Services Description

Gryffin Global Capabilities

Use Cases

Services Description

Gryffin Global Capabilities

Use Cases

Services Description

Gryffin Global Capabilities

Use Cases

Services Description

Gryffin Global Capabilities

Use Cases

Services Description

Gryffin Global Capabilities

Use Cases

Services Description

Gryffin Global Capabilities

Use Cases

Frequently asked

How quickly can Gryffin start an engagement?

Do you work with our existing security tooling?

What is the difference between a penetration test and a red team exercise?

Can you help us achieve certification, or only prepare for it?

Talk to us about Technology, SaaS & Product