Code audit & DevSecOps
We review code and software delivery, integrating security checks into developers’ daily work to identify risky mistakes earlier.
01 / ASSESSMENT
Combine manual code review with automated checks. Examine access controls, secrets, third-party dependencies and CI/CD build and release workflows. Connect remediation to developer tasks and release requirements.
PRACTICAL SCENARIOS / TTP
TTPs are an adversary’s tactics, techniques and procedures. We analyse these approaches and select scenarios for your environment and the scope agreed in writing, connecting each assessment result to practical defensive guidance.
Trace external data from input to consequential actions. Manually review authorisation, input handling and business logic. Confirm SAST findings against execution paths and explain them in the relevant file and component context.
Review the SBOM dependency inventory, secrets, build agents and release artefact access. Assess how a compromised dependency or overprivileged automation identity could affect a release. Specify signing, approval and separation improvements.
DAST tests a running application in the context of API behaviour and access roles. Scope can include container images, service identities and environment configuration. Separate release-blocking issues, planned remediation and retest criteria.
02 / OUTCOMES
Work proceeds under the system owner’s written authorisation, a contract and a confidentiality agreement. Assets, methods, timing, stop conditions and data handling are defined before work begins.
Send your requirements through CyberTrust. We will clarify asset count, assessment depth and expected outcomes with you, then set out timing and pricing in the proposal.