Cyber Security & Resilience Services
Lower the odds of a breach, and the cost of one.
Boards, insurers, and regulators now expect security to be governed, independently tested, and recoverable, not just purchased. Under NIS2, DORA, and ISO 27001 themes, leadership answers for how the organisation prevents, withstands, and recovers from an attack. We bring security leadership, independent testing, cloud hardening, compliance preparation, training, and continuity planning together as scoped engagements, so spend is predictable and nothing runs without your sign-off.
What you get
- One accountable owner for security priorities, with reporting the board can act on
- Independent proof of where attackers could get in, with fixes confirmed by re-testing
- Preparation for NIS2, DORA, GDPR, and ISO 27001 obligations, with audit-ready evidence
- Tested recovery and continuity plans, so operations keep running through an incident
What is inside
The detail behind this pillar, one service at a time. Each is a scoped, authorized engagement, defined with you before anything runs.
Virtual CISO
Security leadership, without the full-time hire.
Ongoing security leadership for teams that need the judgment of a CISO but not a six-figure full-time role: policy ownership, a prioritised roadmap, board and leadership reporting, vendor and third-party risk oversight, and incident-readiness planning, delivered by a senior practitioner on retainer.
- One senior practitioner accountable for your security roadmap
- Board- and leadership-ready reporting, not raw scanner output
- Vendor and third-party risk reviews as part of the retainer
- Works alongside your existing team; does not replace them
How is this different from the compliance and risk service?
Compliance and risk is project-based: a gap analysis and evidence pack for a specific framework. Virtual CISO is an ongoing retainer covering security leadership and decisions across your whole program, including but not limited to compliance work.
Security consulting
Hardening plans your team can act on.
Architecture review, hardening plans, and hands-on fixes for cloud and network estates, delivered by senior practitioners under a written scope.
- Starts from the estate you already run
- Findings ranked and assigned to owners
- Your team keeps the plan and the evidence
Human-led penetration testing and audits
Tested by people. Every finding comes with a fix.
Penetration tests and security audits run by our practitioners under written scope: web applications, APIs, networks, and cloud. Every finding is validated by a person before it is reported, with reproduction steps, remediation guidance, and re-testing of fixes.
- Web applications, APIs, cloud tenants, and networks you own
- Every finding validated by a person before it is reported
- Re-testing included to confirm each fix
What do you need from us before testing starts?
Proof that you own or are authorised to test each target, plus a signed scope covering targets, windows, and rules of engagement. Nothing is tested without both.
Do you test systems we do not own?
No. We test only systems with verified ownership and signed scope — never prospects, customers, or third parties.
Cloud Security
Secure today. Enable tomorrow.
Cloud configuration reviews and practical hardening for the environments your team runs, with clear priorities for identity, network, logging, and workload controls under a written scope.
- Reviews cloud configuration against the environment you operate
- Hardening priorities for identity, network, logging, and workloads
- A practical plan your team can carry forward
Compliance and risk
Evidence for the frameworks you answer to.
Gap analysis and evidence preparation designed for audit readiness against ISO 27001, ISO/IEC 42001, GDPR, NIS2, DORA, the EU AI Act, and the EU Cyber Resilience Act themes, including internal audit and control mapping ahead of ISO/IEC 42001:2023 (AI management systems). This is preparation support, not legal advice, and no company certificate is implied.
- Maps your controls to the frameworks in scope
- Internal audit and gap mapping against ISO/IEC 42001:2023 for teams building or deploying AI systems
- Produces a gap register and an evidence pack
- Prepares your team for the auditor's questions
Security training
Start with the basics. Finish with a certificate.
People-led courses taught by a working practitioner: an introduction to cyber security and a hands-on getting-started course for cloud security with lab environments holding no real data. Request the syllabus through the contact page — no prices are published; every enquiry is scoped individually.
- Outcome first, syllabus second
- Hands-on labs for the cloud course
- Certificate on completion
Disaster Recovery
Prepare. Recover. Continue.
Backup and recovery planning, recovery testing, and continuity runbooks that help your team prepare for disruption and make recovery steps clear. Disaster recovery restores systems and data; it pairs with business continuity, which keeps the business itself operating while that happens.
- Backup and recovery planning around your critical systems
- Recovery tests that exercise the steps your team will use
- Continuity runbooks with clear owners and actions
Business Continuity
Keeps the business running, not just the systems.
Business impact analysis, continuity strategy and plans, crisis roles and communication, and exercises and tabletop tests — built so your organisation keeps operating through a disruption. We assess against ISO 22301 as a reference framework; Pentforge does not issue certifications and makes no compliance or SLA claims. Business continuity keeps the business operating; disaster recovery restores the systems and data behind it.
- Business impact analysis identifying what must keep running and for how long
- Continuity strategy and written plans covering people, process, and facilities
- Crisis roles and communication defined before an event, not during one
- Exercises and tabletop tests that rehearse the plan with your team
How is this different from disaster recovery?
Disaster recovery restores systems and data after a disruption. Business continuity keeps the business itself operating while that happens — people, process, and communication, not just infrastructure. The two are complementary and often planned together.
Discuss Cyber Security & Resilience Services?
No pricing published. Every engagement is scoped individually.
Book a scoping call