Eight Mile · Security · London
Security audits in London.
Find out what is exposed before somebody else does. Security cleared engineers, based in London, review your cloud accounts, networks and applications and hand you a report in plain English: what we found, what it would cost you, and the fixes ranked by what to do first.
Scope
We look where the problems live.
An audit can cover one of these or all six. Most businesses start with the cloud account, email and the office network, because that is where the surprises usually are.
Cloud accounts
AWS, GCP and Azure configuration: who has access and whether they should, what is reachable from the internet, how secrets are kept, what the bill says about resources nobody remembers.
Networks
Office and site networks: firewall rules, Wi-Fi security, segmentation between guests, staff and payment systems, remote access, and the router settings nobody has looked at since installation.
Applications
Websites, web applications and APIs: authentication flows, session handling, what the forms accept, dependency versions with known vulnerabilities, and what an unauthenticated visitor can reach.
Data and continuity
Where your data lives and who can read it, whether the backups exist and restore, what a lost laptop or a leaver keeping their password would mean, and your posture against UK GDPR.
Identity and email
Microsoft 365 or Google Workspace: who holds admin rights, whether multi-factor sign-in is enforced, which leavers still have accounts, and whether SPF, DKIM and DMARC stop somebody sending mail as you.
Devices and people
Laptops and phones: disk encryption, screen locks, updates and what is installed. Then the human side: shared passwords, what a convincing phishing email would get, and whether anyone would notice.
How it runs
Four steps, agreed before we start.
You know what we will look at, what it costs and when the report lands before anyone logs into anything.
01
Scope
A call to agree which systems and areas are in, what access we need, and the fixed price.
02
Review
We read the configuration, test what is exposed, and visit the office for the network.
03
Report
Every finding with its evidence and severity, and the fixes ranked by what to do first.
04
Retest
Once the fixes are in, we check them and update the report, so it ends with evidence.
Who it's for
From a ten-person office to an enterprise estate.
The same review, scaled to what you run. A small business usually needs the six areas looked at once; a larger one usually needs one area looked at properly.
Small and medium businesses
Know what is exposed, in plain English.
No security team, a supplier who set things up years ago, and a nagging sense that something is open. The report is written for the owner, with the fixes ranked so the first afternoon of work removes the worst of it.
Enterprise IT and compliance
An independent pair of eyes.
Before an internal review, a customer’s supplier questionnaire or an insurance renewal. We review the estate your team runs, report findings with evidence your auditors can check, and retest once the fixes land.
Before a change
Check it before you move it.
A cloud migration, a new office, a product launch or a change of IT supplier is the cheapest moment to find a problem. We review what exists, so the new setup starts from a clean baseline rather than inheriting the old gaps.
Straight answers
The questions people ask first.
What you get
A report, a plan, and a retest.
An audit that ends in a PDF nobody acts on is theatre. Ours ends when the ranked fixes are verified.
01
The report
Every finding with its severity, the evidence, and what it means for your business in plain English. Written to be read by the owner, not just the IT contact.
02
The remediation plan
The fixes in the order they are worth doing, each with a rough cost and effort. Some will be ten minute configuration changes; the report says which.
03
The retest
Once the fixes are in (done by your team, ours, or whoever runs your systems), we test again and update the report, so you finish with evidence rather than intentions.
Audits are carried out by the same security cleared engineers who build and run these systems for a living, so the advice is what we would do ourselves, not a checklist.