Advisory & training
Facilitated workshops that map how a system or feature could be attacked before it is built or shipped. We draw the data flows with your engineers, walk them with STRIDE, rank the threats by likelihood and impact, and turn the result into backlog items and test cases your team owns.
A 45-minute scoping call picks the system to model, then workshops with your engineers turn its design into a ranked threat register and backlog items your team owns.
45 minutes
We agree which system or feature to model, which of your engineers need to be in the room and whether the workshops run remotely or on site.
Fixed quoteProposed datesWritten scope by email
2 to 5 days per system
We draw the data flows and trust boundaries with your engineers, walk every element and flow with STRIDE, add PASTA for regulated or high-impact systems and work through abuse cases for your product's own flows.
Data-flow diagramsAbuse cases
Included
Each threat is ranked by likelihood and impact and given an owner, each mitigation becomes a backlog item with the security test that will prove it, and the workshop format is written down so your team can run the next session without us.
Ranked threat registerBacklog itemsSecurity test casesWritten workshop format
Threat modelling workshops and secure-coding labs in which your engineers exploit, then fix, bugs like their own.
Hands-on workshops for engineers, run against a deliberately vulnerable copy of a codebase like yours. Developers exploit each bug before they fix it, so they have seen the attack their fix has to stop, and review real pull requests for the same bugs.
Duration: 1 to 3 days on site or remote
Often not yet. If you have no customers and no sensitive data, a threat modelling workshop on the product you are about to launch, plus the free secure-defaults checklist for new products in our knowledge hub, will do more for you than a penetration test, and the workshop leaves the first test a list of threats to check.
We can usually hold the scoping call within two working days and start work within two weeks of a signed scope. If a deal deadline cannot wait that long, say so when you get in touch and we will give you the earliest date we can start. For an active incident, skip the scoping call and phone +972 52 613 9179.
Yes. We sign your NDA before the scoping call if you ask, and work under it for the whole engagement. Engagement data is encrypted at rest and destroyed when the engagement closes, or on a schedule you set. Send your supplier security requirements before the scoping call and we will tell you in writing which we meet.
Yes. We test remotely for clients outside Israel. Israel is two hours ahead of UK time and one hour ahead of Central European time, so most of our working day overlaps yours. On-site work, such as internal network testing, physical assessments and training, is agreed on the scoping call.
A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.