Strategic Security Advice
Independent advice from people who spend their working lives breaking into organisations, sized to the question you actually have, from a single day to four weeks.
We have nothing to sell you but our opinion
Security advice is only worth anything if the person giving it has no stake in the answer.
CREDS is self-funded and fully owned by the people who work here. We have no parent company setting our targets, no investor timeline shaping our recommendations, and no vendor relationships to protect. We do not resell products, we do not take referral fees, and we do not have a licence quota to fill.
That means when we tell you a tool you already own is sufficient, or that the right answer is to fix a process rather than buy something, there is nothing behind the advice except the advice.
It also means we will tell you when the answer is not us. If a problem needs a governance consultancy, an awareness programme or a managed service, we will say so and point you at someone good.
Strategic advice with a hacker mindset
Most security advice comes from people who have read about attacks. Ours comes from people who carry them out.
That changes what you get. When we review an architecture, we are not checking it against a framework, we are working out where we would start if we were asked to break it. When we look at a roadmap, we are asking which of these twelve initiatives would actually have stopped the last three engagements we ran. When we assess a control, we know what it looks like from the other side, because we spend most of our time on that side.
Our consultants are not a separate advisory practice. They are the people who lead our red team and penetration testing engagements, which means the advice is grounded in what is currently working against organisations like yours rather than in what the guidance said last year.
Every engagement is guided by someone with more than a decade of experience.
The questions people bring us
Advisory work covers a lot of ground. These are the questions that come up most often. If yours is not here, it is still worth asking.
Where do we start?
You know the security programme needs work and you do not know which end to pick up. We help identify the quick wins, the low-hanging fruit that reduces real risk in weeks rather than quarters, and separate them from the work that genuinely needs a project behind it.
What should our roadmap be?
A multi-year security roadmap, built around your actual risk profile and threat landscape rather than a generic maturity model. What to do this quarter, this year, and what can honestly wait.
Are we spending money in the right places?
Security budgets accumulate. We review what you are spending, what it is buying, and where the same money would reduce more risk somewhere else. Sometimes the answer is that you already own the right tool and are not using it properly.
We are building something new. How do we get it right?
Architecture and design review before anything is built, with threat modelling from an attacker's perspective. Fixing a design flaw on a whiteboard costs a conversation. Fixing it after launch costs a release cycle.
How secure is the company we are about to acquire?
Security due diligence for acquisitions and investments: what you are buying, what you are inheriting, and what it will cost to bring up to standard. Scoped to your transaction timeline.
Is our existing setup actually sound?
An independent read on systems, architecture and controls you already have in place, from people who will tell you when the answer is yes.
The platform watches continuously. We step in when it matters.
Buying advice usually means buying availability: a retainer, a fixed number of days a month, a fractional CISO on a standing contract. You pay for continuity because there is no other way to get it.
We approach it differently. Where you run our ART platform, the continuity comes from the platform. It tests continuously, tracks what changes, and surfaces what has moved, without anyone needing to be in a meeting for it to happen.
That frees our consultants to do the thing people are actually valuable for: judgement. What does this finding mean for the business? Which of these three problems matters most given what we know about your sector? Is this worth a project or a config change? Should you be worried about this, or is it noise?
The platform handles the watching. We come in when there is something worth thinking about.
This also means advice that can be validated. We can recommend a change, and then the platform can confirm whether the control actually works, rather than leaving you to assume it does.
Advisory engagements stand on their own, and they also work alongside an ART subscription. You do not need the platform to bring us a question.
Sized to the question
Some questions take a day. Some take four weeks. Very few take a year, and we would rather not sell you one.
A CREDS advisory engagement is scoped to the question you actually have. That might be a single day working through a design decision with your architects, or a week reviewing where your security budget should go next year, or four weeks of due diligence on an acquisition against a transaction deadline.
What it is not is a standing retainer you have to justify internally every quarter. You bring us a question, we tell you roughly what it will take to answer it properly, and when it is answered, it is answered.
If the relationship becomes ongoing, good, and most of them do. But that should be because you keep having questions worth asking, not because you signed something.
A day
A design decision, a second opinion on an architecture, a workshop with your team, or a sanity check on a plan.
A week or two
A roadmap, a security investment review, or an assessment of where to start.
Up to four weeks
Due diligence against a transaction deadline, a full architecture review, or a programme built from scratch.
How an engagement runs
- 01
You bring us the question
A short conversation, no charge, to work out what you are actually trying to decide. Often the question people arrive with is not quite the question that needs answering, and that is worth establishing before anyone quotes anything.
- 02
We scope it honestly
We tell you what it will take: how many days, who from our side, and what we will need from yours. If we think the question can be answered in less time than you expected, we say so.
- 03
We do the work
Interviews, document and architecture review, technical examination where relevant, and direct conversation with the people who know how things actually run rather than how they are documented.
- 04
We tell you what we think
A written deliverable and a session to work through it, pitched at whoever needs to act on it: your architects, your security team, or your board.
What you receive
A clear answer to the question you asked. With the reasoning behind it, not a maturity score.
Prioritised recommendations. Separated into what to do now, what to plan, and what can wait.
The quick wins called out explicitly. What you can fix in the next few weeks with the people you already have.
A written deliverable. Sized to the engagement: a memo for a one-day question, a full report for a four-week one.
A working session. To go through it with the people who have to act.
A straight answer on what we cannot help with. And who can.
Who we usually work with
CTOs and engineering leaders
You are building something and you want the security decisions made correctly the first time, by someone who will engage with the architecture rather than hand you a checklist.
CISOs and security managers
You need an independent read on a roadmap, a budget, a supplier, or a plan you are about to take to the board, from people with no stake in the outcome.
Boards, investors and corporate development
You need to know what you are buying, what you are inheriting, and what it will cost to fix, inside a transaction timeline.
IT managers without a dedicated security team
You have the responsibility and not the specialist knowledge, and you need someone to tell you plainly where to start.
Questions about advisory work
How long does an engagement take?
Do we have to sign a retainer?
How is this different from a governance or compliance consultancy?
Do you sell or resell security products?
Do we need the ART platform to work with you?
Can you help us decide where to start?
Can you do security due diligence on an acquisition?
Will you tell us if we do not need you?
Bring us a question
Tell us what you are trying to decide. We will tell you what it would take to answer it properly, and whether we are the right people to do it.