// cybersecurity consultancy
Security work that ends in fixes, not just findings.
Cobalt Fold helps engineering and operations teams see where they are exposed and what to do about it: security assessments, cloud reviews, incident preparation, secure development practice and the policies that hold it together.
## services
What we do
Five services, each scoped to the systems you name and each ending in something your team can act on.
-
services/assessments
Security assessments
A structured test of an application, network or environment, under rules of engagement agreed in writing first. We explain each issue in terms of what an attacker could actually do with it, and rank fixes by effort and impact.
# you get
- written report
- prioritised fix list
- walkthrough with your engineers
- retest of fixed issues
-
services/cloud-reviews
Cloud security reviews
We go through your cloud configuration with your team: identity and access, network exposure, logging, secrets, storage and backups. The aim is a short list of changes that close real gaps, mapped to the accounts and resources where they apply.
# you get
- configuration review
- access and permissions findings
- remediation plan
-
services/incident-readiness
Incident readiness
Preparation for the day something goes wrong: who decides, who gets called, which logs exist and how long they are kept. We write or review your response plan, then run a tabletop exercise so the plan has been practised before it is needed.
# you get
- response plan
- escalation and contact map
- tabletop exercise and debrief
-
services/secure-development
Secure development
Security built into the way your team already ships software: threat modelling for new features, code review guidance, dependency and secrets handling, and pipeline checks that catch problems without blocking every merge.
# you get
- threat models
- secure coding guidelines
- pipeline check recommendations
- team sessions
-
services/policy
Security policy
Policies people can follow: access control, acceptable use, data handling, supplier review and incident response. Written to match how your company actually works, and short enough to be read.
# you get
- gap review of existing policies
- policy set
- rollout notes
## process
How an engagement works
The same four steps whether the work is a single review or a longer piece. Nothing touches your systems until the scope is agreed in writing.
-
scope --agree-rules
Scoping call
You email us and we arrange a call about your systems and concerns. Together we agree what is in scope, what is off-limits, when testing can happen and who to contact if something unexpected comes up.
-
plan --sign-off
Written proposal
A short document covering the work, the deliverables, the timeline and the access we will need. Work starts once you have signed it off.
-
run --share-early
The work itself
We carry out the review, test or workshop. Serious issues are shared with your named contact as soon as we find them, not saved for the report.
-
report && retest
Report, fix, retest
A written report with plain-language findings and a prioritised list of fixes, walked through with your team. Once you have made changes, we check them.
$ contact --new-engagement
Start with an email
address:
hello@cobaltfold.com# worth including
- What you run: products, platforms, cloud providers
- What prompted you to look at security now
- Any launches, audits or deadlines you are working towards
# please leave out
- Passwords, keys or access tokens
- Details of vulnerabilities that are not yet fixed
We will agree a secure way to share these in our reply.