Independent technical and security consulting for software and web systems.
What we do
Four kinds of engagement, each scoped and priced individually, each ending in a written report the client can act on.
Security assessment
A structured review of a web application, API or service for exploitable weaknesses: authentication, access control, input handling, session management and the configuration around them.
About security assessments →Code and delivery review
Review of application source code, build pipelines and dependencies, and of how your pages and software reach users, so that what they receive is exactly what you published.
About code and delivery review →Architecture advice
Threat modelling and design review for new systems or significant changes, so that security decisions are made before the system is built rather than patched afterwards.
About architecture advice →Technical due diligence
An independent review of a company's software, security and engineering practice for an investor, acquirer or partner who needs to understand what they are committing to.
About technical due diligence →How an engagement runs
Every engagement follows the same four steps, and the scope is agreed in writing before any work starts.
Scoping
A short call to understand your systems and concerns, followed by a written proposal setting out scope, deliverables, timeline and fee.
Agreement
A signed services agreement and, where you require it, a confidentiality agreement. Access to systems and code is arranged on your terms.
Assessment
The work itself, carried out remotely. You are told immediately about any finding that is serious enough not to wait for the report.
Report and follow-up
A written report of findings ranked by risk, each with a concrete remediation, and a walkthrough with your team.
Businesses that operate websites and online services
Our clients are companies whose product, or whose relationship with their customers, depends on software they run on the web: online services, software-as-a-service products, e-commerce and the companies that build these for others. We also work for investors, acquirers and partners who need an independent technical view of such a company before committing to it.
Engagements are typically commissioned by a founder, CTO or head of engineering who wants an independent view of a system before launch, after a significant change, or because a customer or partner has asked for one.
Our own security software
Alongside consulting, RecursivX develops security software for operators of websites and online services. This work informs our consulting, particularly on the integrity of software delivery, and is currently in development.
Discuss an engagement.
Tell us what you run and what concerns you. We will come back with questions, then a written proposal.