Cyber and quantum security

Because of harvest now, decrypt later. Traffic recorded today can be decrypted once a capable quantum computer exists, so data that must stay secret for years is at risk already. Migration also takes years in a large estate, and national PQC transition roadmaps are setting deadlines for it.

Read more: Post-quantum cryptography and quantum-safe encryptionLink to this question

A CBOM lists every cryptographic algorithm, key and certificate in your systems and where each is used, much as a software bill of materials lists components. It shows what must change, and it lets you prove to an auditor that nothing vulnerable is left.

Read more: Post-quantum cryptography and quantum-safe encryptionLink to this question

Not if the change is staged. Post-quantum keys and signatures are larger, and some older devices and partners cannot handle them yet. We use hybrid modes and a dual-stack PKI during the transition, test each system against its partners, and keep a rollback path.

Read more: Post-quantum cryptography and quantum-safe encryptionLink to this question

The NIST post-quantum standards: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), applied in protocols such as TLS 1.3. We align the plan with the national PQC roadmaps and sector rules that apply to you, in the Middle East, Europe and Asia.

Read more: Post-quantum cryptography and quantum-safe encryptionLink to this question

A non-human identity is any account, key or token used by software instead of a person: service accounts, API keys, and now AI agents. They are easy to create and easy to forget, and many never expire. An AI agent that acts on its own with such a key can do a great deal of harm if it is misled or the key is stolen.

Read more: Agentic AI security and AI agent identityLink to this question

An attack that hides instructions in content an AI model reads, such as an email, a document or a web page, so the model follows the attacker instead of its user. It cannot be prevented by the model alone. Defence combines guardrails on inputs and outputs, agents with limited access, and human approval for sensitive actions.

Read more: Agentic AI security and AI agent identityLink to this question

Instead of a permanent key, the agent asks for access when a task starts. It receives a credential limited to that task and that time, and the credential expires when the task ends. Every request is logged, so you can see which agent did what and on whose behalf.

Read more: Agentic AI security and AI agent identityLink to this question

We agree the scope and rules, then attack your models and agents the way an adversary would: jailbreaks, prompt injection, tool poisoning and attempts to extract data. You receive every finding with the steps to reproduce it, ranked by risk, and we retest after the fixes.

Read more: Agentic AI security and AI agent identityLink to this question

It depends on the provider's terms, the region it runs in and what you send it. We review those three, add leakage controls in front of the model and, where the data may not leave your jurisdiction, recommend a sovereign or private model instead.

Read more: Agentic AI security and AI agent identityLink to this question

Not at once. Zero trust is introduced in stages, usually starting with the most sensitive applications and administrator access. The VPN can stay for what still needs it and is retired once nothing depends on it.

Read more: Exposure remediation, zero trust and DevSecOpsLink to this question

A software bill of materials lists every component and library inside a piece of software, with its version. When a new vulnerability is announced, it tells you quickly whether you are affected and where. Regulations such as the EU Cyber Resilience Act (CRA), and many customers, now ask for one.

Read more: Exposure remediation, zero trust and DevSecOpsLink to this question

Each engineer has a named account with only the rights the task needs, and signs in with a hardware security key. Where you have a process for administrator access, we follow it. Sessions are logged, and access is removed when the work ends or someone leaves the project.

Read more: Exposure remediation, zero trust and DevSecOpsLink to this question

A standing programme instead of an annual test. It keeps a current list of what an attacker could reach, ranks each exposure by how likely it is to be used and what it would cost you, and tracks every fix until it is closed. Scanning runs continuously and testing follows every significant change.

Read more: Exposure remediation, zero trust and DevSecOpsLink to this question

A rehearsal under real conditions. A red team attacks your systems within agreed rules, while your blue team, the people who detect and respond, defends them. Afterwards both sides review what was found, what was missed and how long each step took, and you receive the changes that close the gaps.

Read more: Exposure remediation, zero trust and DevSecOpsLink to this question

Yes. Monitoring is designed with your control engineers to observe control traffic rather than change it, and any change on plant systems follows your change and safety procedures. Safety and uptime come first.

Read more: Converged SOC/NOC, cyber resilience and OT/IoT defenceLink to this question

Restoring systems into an isolated environment first, checking that the restored systems and data are free of the attacker, and only then returning them to service. It stops a recovery from reinfecting the network.

Read more: Converged SOC/NOC, cyber resilience and OT/IoT defenceLink to this question

Start with the systems that would hurt most if they were attacked: usually the ones that hold customer or payment data, move money or keep the business running. A focused assessment of them shows the weaknesses that matter and gives you a ranked plan. If you use AI agents or hold data that must stay secret for years, the post-quantum and agent security audit is the natural first step.

Read more: Cyber & QuantumLink to this question

We do not claim certificates of our own. Our operations, source code and the cloud workloads we run for clients sit on infrastructure whose providers hold those attestations, and we engineer your systems to pass the audits you face. Our security and trust page explains how.

Read more: Cyber & QuantumLink to this question

Yes. We compare your controls with the standard or regulation you must meet, such as DORA, NIS2, the Saudi NCA ECC or SAMA rules, show the gaps and help you close them. You keep evidence that an auditor can check. We do not certify you ourselves: certification is granted by an accredited body, and we help you prepare for its audit.

Read more: Cyber & QuantumLink to this question

An assessment reviews how your systems are designed, configured and run, and finds the gaps against recognised good practice. A penetration test attacks the systems within agreed rules, to show what an attacker could actually reach. The two work best together: the assessment shows the breadth of the problems, the test shows their depth.

Read more: Cyber & QuantumLink to this question

We plan testing to avoid harm. The systems, times and methods are agreed in advance. We test in a non-production environment when it matches production closely enough, and avoid disruptive tests unless you approve them. A named contact on your side can stop the test at any time.

Read more: Cyber & QuantumLink to this question