Advisory & training
Hands-on workshops for engineers, run against a deliberately vulnerable copy of a codebase like yours. Developers exploit each bug before they fix it, so they have seen the attack their fix has to stop, and review real pull requests for the same bugs.
A 45-minute scoping call, a curriculum and lab prepared before the course, then workshops in which your engineers exploit and fix each bug.
45 minutes
We agree the languages, frameworks and vulnerability classes the course covers, who attends and whether it runs on site or remotely.
Fixed quoteProposed datesWritten scope by email
Before the course
We build the curriculum from findings in your own codebase and set up the lab, a deliberately vulnerable copy of a codebase like yours. The assessment runs once before the first session.
Tailored curriculumLab environmentFirst assessment
1 to 3 days, on site or remote
Engineers exploit each bug in the lab before they fix it, practise secure code review on real pull requests and threat model a feature from your backlog.
Recorded sessionsWritten exercises
After the course
The same assessment runs again and both scores are reported, alongside a secure-coding checklist adapted to your stack.
Both assessment scoresSecure-coding checklist
Threat modelling workshops and secure-coding labs in which your engineers exploit, then fix, bugs like their own.
Facilitated workshops that map how a system or feature could be attacked before it is built or shipped. We draw the data flows with your engineers, walk them with STRIDE, rank the threats by likelihood and impact, and turn the result into backlog items and test cases your team owns.
Duration: 2 to 5 days per system, remote or on site
The recorded sessions and written exercises, a secure-coding checklist adapted to your stack, and the scores from the same assessment taken before and after the course. The lab environment is theirs for the duration of the course.
We can usually hold the scoping call within two working days and start work within two weeks of a signed scope. If a deal deadline cannot wait that long, say so when you get in touch and we will give you the earliest date we can start. For an active incident, skip the scoping call and phone +972 52 613 9179.
Yes. We sign your NDA before the scoping call if you ask, and work under it for the whole engagement. Engagement data is encrypted at rest and destroyed when the engagement closes, or on a schedule you set. Send your supplier security requirements before the scoping call and we will tell you in writing which we meet.
Yes. We test remotely for clients outside Israel. Israel is two hours ahead of UK time and one hour ahead of Central European time, so most of our working day overlaps yours. On-site work, such as internal network testing, physical assessments and training, is agreed on the scoping call.
A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.