Application and API review
Authentication, authorization, input paths, data exposure, business logic, secrets and dependency risks across the agreed surface.
Security engineering services
Find the weakness. Preserve the evidence. Prove the fix.
ANULUM reviews software, infrastructure and AI-integrated systems within a written authorisation boundary. Findings are tied to affected assets, reproducible evidence, practical remediation and—when contracted—a controlled retest.
01Authority signed02Surface bounded03Findings evidenced04Fixes retested
Six service lines
The exact methods follow the assets, threat model, business impact and agreed rules of engagement.
Authorised penetration testing
Controlled grey- or black-box testing under signed targets, exclusions, timing, safety limits, contacts and evidence handling.
Security-focused code review
Manual and tool-assisted inspection of high-risk paths, trust boundaries, cryptographic use, failure handling and dependency custody.
Infrastructure hardening
Identity, network, host, container, TLS, logging, backup and administrative paths reviewed against the agreed baseline.
Incident readiness
Roles, escalation, containment, evidence preservation, communication, recovery and tabletop exercises before an incident demands them.
AI and agent security
Prompt injection, retrieval poisoning, tool authorization, cross-role disclosure, model supply chain and unsafe failure behaviour.
The deliverable is a decision packet
| Object | What it records |
|---|---|
| Rules of engagement | Named systems, authority, methods, exclusions, safety stops, contacts, timing and evidence custody |
| Executive view | Business impact, affected boundary, prioritised decisions and material uncertainty |
| Technical findings | Reproduction, evidence, severity rationale, affected versions and safe handling notes |
| Remediation plan | Recommended control, owner, dependency, acceptance test and sequencing |
| Retest record | Exact fix and version tested, result, remaining exposure and closure decision |
How we work
- Authorise and scope Confirm ownership or delegated authority, systems, data, methods, exclusions and emergency stop contacts in writing.
- Map and test Establish the attack surface and apply controlled review or testing while preserving a clear evidence chain.
- Report and decide Separate verified findings, reasonable hypotheses and unavailable evidence; agree remediation priorities.
- Retest and close Verify contracted fixes against the exact changed system and record residual risk or further work.
Important boundary
A security review is not a certificate.
Testing provides evidence about the agreed systems, methods and time window. It does not prove the absence of vulnerabilities, certify legal compliance or replace independent legal, regulatory or accredited certification advice.
See the deployment control set → Inspect the public Trust Centre →