Cyber Security
Everything that makes software safe to ship: the pipeline gates, the dependency supply chain, the APIs that now carry most traffic, and the developer enablement that makes the whole thing sustainable.
What we deliver
Every engagement is scoped to your environment - deploy a single capability or the full stack.
Security gates inside the pipeline that developers do not route around, because they are fast and specific.
A managed function across the whole portfolio rather than a test per release.
Design flaws found while they are still a whiteboard change.
Automated testing tuned to a signal level developers will act on rather than mute.
Know what is inside your software before a customer, an auditor or an advisory asks.
Every API found - including the undocumented and deprecated ones - and policy placed in front of them.
Credentials out of repositories, images, pipeline variables and config maps.
One prioritised view of application risk across scanners, pipelines, repositories and runtime.
The platform most new workloads land on, secured from build through admission to runtime.
Training driven by the vulnerability classes your own code keeps producing.
Technical deep dive
Applies to any platform whose APIs were built for a single first-party consumer and later opened to partners, mobile clients or an ecosystem.
What this is
An API security programme with three layers: discovery from live traffic and from code so the inventory is real, an authorisation model where object ownership is checked centrally rather than in each handler, and pipeline plus runtime controls that stop the class from returning.
The problem being solved
A record endpoint accepts an identifier and returns the full object. Identifiers are sequential. The endpoint verifies that the caller holds a valid partner token - it never verifies that the requested object belongs to that partner. There is no rate limit, because it was written for one first-party client making one call at a time. A partner key issued years earlier, never scoped and never rotated, is used to walk the identifier range from a rotating residential address pool over a weekend. Nothing alerts: every request is authenticated, well-formed and individually unremarkable.
Why it is hard
Reference architecture - step through it
# 1 ─ authorisation policy: object ownership, decided centrally
package api.authz
default allow := false
allow if {
input.action == "read"
input.object.type == "consignment"
input.object.owner_tenant == input.subject.tenant # the missing check
input.subject.scopes[_] == "consignment:read"
}
# cross-tenant access requires an explicit, audited delegation
allow if {
input.action == "read"
d := data.delegations[input.object.owner_tenant][input.subject.tenant]
d.active
time.now_ns() < d.expires_ns
input.object.type in d.object_types
}
deny_reason := "cross_tenant_object_reference" if {
input.object.owner_tenant != input.subject.tenant
not allow
}
# 2 ─ contract: the registry rejects anything undeclared
paths:
/v2/consignments/{ref}:
get:
auth: partner_token
authorization: object_level # required field; build fails if absent
object: {type: consignment, ref_format: opaque_ulid}
rate_class: partner_read # 120/min burst 40, per credential
deprecated_alias: /v1/shipment/{id} # legacy route, now proxied + logged
# 3 ─ runtime: enumeration is a property of the series
rule ENUM-002:
window: 10m
per: credential
signals:
distinct_object_refs > 500
not_found_ratio > 0.35 # walking a range produces misses
monotonic_ref_progression == true
breadth_vs_baseline > 20x
ignore: [source_ip] # rotating pools defeat address logic
action: throttle → challenge → suspend_credential
notify: partner_account_owner + detection_pipelineMeasured change
| Measure | Before | After |
|---|---|---|
| Documented API surface | 84 endpoints | 312 discovered, 312 registered |
| Endpoints with object-level authorisation | handler-by-handler, unverified | 100% via central decision |
| Time to contain the live abuse | N/A | same day, policy-level virtual patch |
| Enumeration detection | none | sequence-scored, source-independent |
| New routes shipped without an authZ model | routine | 0 - build fails |
The fix that mattered was structural: authorisation stopped being something each handler had to remember and became something the platform decides. The inventory made the problem visible; the central decision made it non-recurring.
Schedule a free consultation and our team will connect within 12 hours to understand your environment and map out the right approach.
We respond within 12 hours