Technology
Your buyers distrust claims and must report incidents within hours.
We build positioning, trust centres, analyst consoles and AI copilots for security vendors, managed security providers and audit firms. Every claim is tied to evidence, and every copilot is red-teamed before release.
Where the rules biteMap of all forty-one industries
What is shifting
Products now carry reporting deadlines, buyers ask for SBOMs, audits rate exploitability and the CCPA has penalised a fear-led renewal screen. Each shift names what it demands, with a fact you can check.
What it requiresProducts with vulnerability and incident reporting designed in, from detection to the regulator’s form.
EvidenceSince 11 September 2026, the EU Cyber Resilience Act requires makers of digital products to give early warning of actively exploited flaws within 24 hours.
What it requiresSBOMs, AI bills of materials and evidence packs that a procurement team can check.
EvidenceCERT-In’s guidelines of 9 July 2025 set minimum elements for software, crypto, AI and hardware bills of materials and urge buyers to make SBOMs standard.
What it requiresFindings ranked by risk and likelihood of exploitation.
EvidenceCERT-In’s audit policy guidelines of 25 July 2025 call for at least one audit a year. Findings are rated by CVSS severity and EPSS likelihood.
What it requiresClaims and renewal screens that inform without threatening.
EvidenceIn June 2026 the CCPA fined a security-software company whose renewal screen offered ‘Renew now’ or ‘Accept risk’, finding the choice was not neutral.
The rulebook
We set out how CERT-In’s directions and guidelines, NIS2, the Cyber Resilience Act, consumer-protection rules and the DPDP Act apply to a security vendor. Your counsel and auditors confirm the position.
Frameworks we build to
We design and build to these frameworks; this is not a claim of certification.
Often shapes the work
Central Consumer Protection Authority
The Consumer Protection Act bars misleading advertisements, and fear-based or manipulative choices are dark patterns. In June 2026 the CCPA penalised a security-software renewal screen that framed declining as accepting risk.
We designEvery detection, coverage or ‘AI-powered’ claim is tied to evidence, and renewal copy states facts without threats.
Consumer Protection Act, 2019 · CCPA Dark Patterns Guidelines, 30 November 2023 · CCPA order of June 2026 Official text: Consumer-protection rules on claims and dark patterns
Shapes most of the work
Indian Computer Emergency Response Team
Minimum elements for software, quantum and crypto, AI and hardware bills of materials. The public sector, essential services and software exporters are urged to make them standard in procurement.
We designBills of materials are generated in the build and shared with customers in a form they can read.
CERT-In · Technical Guidelines, version 2.0, 9 July 2025 Official text: CERT-In guidelines on SBOM, QBOM, CBOM, AIBOM and HBOM
European Union
From 11 September 2026, makers of products with digital elements report actively exploited vulnerabilities and severe incidents. An early warning is due within 24 hours and a notification within 72. The security requirements apply from 11 December 2027.
We designVulnerability handling, disclosure pages and the SBOM are designed into the product from the start.
Regulation (EU) 2024/2847 · Article 14 from 11 September 2026 · Article 71 Official text: EU Cyber Resilience Act
Often shapes the work
Ministry of Electronics and IT
Logs and telemetry often hold personal data, and processors work under contract. From 13 May 2027, fiduciaries report breaches to the Data Protection Board and the people affected. A detailed report to the Board follows within 72 hours.
We designTelemetry is minimised and tagged, so a breach report can say whose data was touched.
DPDP Act, 2023 · section 8 · DPDP Rules, 2025, rule 7 (from 13 May 2027) Official text: DPDP Act, 2023 and DPDP Rules, 2025
Shapes most of the work
Indian Computer Emergency Response Team
Service providers, intermediaries, data centres, companies and government bodies report listed cyber incidents within six hours of noticing them. They keep logs of all ICT systems for a rolling 180 days within India.
We designDetection and case tools record the moment an incident was noticed, so the six-hour clock can be proved.
CERT-In · Directions under section 70B(6) of the IT Act, 28 April 2022 Official text: CERT-In Directions, 2022
Indian Computer Emergency Response Team
Cyber security audits by CERT-In-empanelled auditors at least once a year, or more often where a sector regulator says so. Findings are rated by CVSS severity and EPSS likelihood of exploitation.
We designAudit reports and remediation trackers sort findings by exploitability and keep the evidence for the next audit.
CERT-In · Comprehensive Cyber Security Audit Policy Guidelines, version 1.0, 25 July 2025 Official text: CERT-In audit policy guidelines, 2025
European Union
Essential and important entities, including managed security service providers, report significant incidents in three stages. An early warning is due within 24 hours, a notification within 72 hours and a final report within a month. Boards approve the measures.
We designCustomer-facing reporting follows the 24-hour, 72-hour and one-month stages, with templates for each.
Directive (EU) 2022/2555 · Articles 20 and 23 Official text: NIS2 Directive
Often shapes the work
OWASP GenAI Security Project
Prompt injection (LLM01), sensitive information disclosure (LLM02), excessive agency (LLM06) and the other risks a security copilot faces when it reads untrusted logs and tickets.
We designCopilots are red-teamed against the list before release, with tools limited to what each task needs.
OWASP Top 10 for LLM Applications, 2025 edition Official text: OWASP Top 10 for LLM Applications
Compiled 3 October 2026. Our reading of typical programmes, not legal advice. Rules change; your counsel confirms how each one applies to you.
Challenges
The problems that come up in most cybersecurity programmes, for customers and for your teams.
Technical buyers want architecture, test results and integrations on the site, without a sign-up form.
Questionnaires, SBOMs and certificates ready the day procurement asks for them.
Fewer, clearer alerts, with the evidence in one view.
What we build
A typical programme here uses each discipline in this mix. Each line says what it builds for the industry and links to the capability behind it.
Positioning a technical buyer believes, with every claim tied to evidence.
Analyst consoles, alert triage and incident views designed with the analysts who use them.
Trust centres, evidence portals and reporting integrations, built and run securely.
Research, threat reports and points of view written for practitioners and AI assistants to cite.
Security copilots that answer from your telemetry and runbooks, red-teamed and limited by permissions.
Account journeys and lead routing for long evaluations with many reviewers.
Programmes
Each programme runs as one of our engagement packages and has its own measure. Durations are typical.
The way in
We check every public claim against the product and its test results, and map what buyers ask for against what you can share.
What you get
02Project · 8–12 weeks
Security posture, sub-processors, SBOMs and reports published in one place, with gated documents released under NDA.
MeasureDays to clear a customer’s security review
Services: Website · Compliance readiness
Enquire about Trust centre and evidence portal03Milestone · 4–9 months
Alert, investigation and reporting views redesigned around how analysts work, with the reporting deadline beside the evidence.
MeasureAnalyst time per alert in the product
Services: Product discovery · Complete UX & UI design · Design system build
Enquire about Analyst console redesign04Project · 8–12 weeks
A copilot that answers from your telemetry and runbooks, tested against prompt injection and excessive agency before customers use it.
MeasureCopilot answer accuracy on the evaluation set
Services: Custom AI agent or copilot · Brand fidelity evaluation · Penetration test (VAPT)
Enquire about Security copilot with red-team evaluationsHow success is measured
Main measureEvaluation-to-contract conversion
AI, under the rules
Each use case treats logs and tickets as untrusted input and has an evaluation set and a log. A person approves every action and every notification.
Use case 01
Measured byAnalyst time per alert
Tested forOWASP LLM01 · Prompt injection
Goes live only with its evaluation set, automatic checks and a named owner
Use case 02
Measured byNotifications sent within their deadline
Tested forOWASP LLM09 · Misinformation
Goes live only with its evaluation set, automatic checks and a named owner
Use case 03
Measured byDays to return a questionnaire
Tested forOWASP LLM02 · Sensitive information disclosure
Goes live only with its evaluation set, automatic checks and a named owner
Work and insights
We publish cybersecurity projects only once a client signs off the write-up. Meanwhile, here is the reading that applies.
A typical programme · composite
A managed security provider rebuilt its site around a public trust centre and a sample incident report. Its analysts got one console view per incident, with the reporting deadline beside the evidence.
Anonymised and illustrative: the shape a programme takes, never a named client.
Questions
Something else on your mind? Ask us directly
Only where the evidence does not support them. We keep a register tying each claim to a test result, report or documented capability. Claims that cannot be shown are rewritten.
Yes. Managed services carry their own reporting duties: to CERT-In in India and, for EU customers, under NIS2. We design the customer-facing reporting and evidence around them.
It can be tested, limited and logged before customers use it. We evaluate it on your analysts’ questions and red-team it against the OWASP Top 10 for LLM Applications and MITRE ATLAS techniques. It keeps to read-only tools unless a person approves an action.
No. Certificates come from accredited certification bodies and SOC 2 reports from independent auditors. We build the systems, pages and evidence that help you prepare for those audits.
Keep exploring
You will speak to a lead who would run the work, and get a straight answer on fit.
01About 2 minutes
You get A reply from a named lead
02About 8 minutesRecommended
You get Options and a first scope after one call
03About 15 minutes
You get Receipt confirmed and a named bid lead
Every engagement starts with a written scope and a quote agreed before work begins. How each package is priced
