Security services for organisations that carry regulatory weight

Penetration testing at INLD is a manual discipline supported by tooling, not the other way round. We begin from an agreed scope and rules of engagement, map the attack surface, and then work through authentication, authorisation, session management, input handling, business logic and data exposure in the order that risk dictates. Automated scanners are used with tuned rulesets to clear ground quickly; every candidate finding is then verified by hand so the report contains no unconfirmed scanner output. Where exploitation is authorised, we produce controlled proof-of-concept evidence to establish real impact rather than theoretical severity. Findings are documented with reproduction steps precise enough for a developer to follow without contacting us.

Most cloud incidents we see are not exotic. They come from identity policies that grew permissive over time, storage that became reachable through a chain of defaults, secrets committed to build pipelines, or logging that was never routed anywhere an analyst would look. Our cloud assessment reviews the account or subscription structure, identity and access management, network segmentation, data storage and encryption, secrets handling, and detection coverage. We work from the CIS Benchmarks and the relevant provider well-architected security guidance, then apply the client's own regulatory context to decide what actually matters. The output separates control gaps that create present exposure from those that create audit findings, because the two need different response timelines.

Digital asset platforms fail at the seams: between the trading engine and the withdrawal path, between the signing service and the approval workflow, between what the key ceremony documented and what operations actually does on a Friday evening. Our assessments treat key material and withdrawal authorisation as the crown jewels and work outwards. We review hot, warm and cold wallet architecture, HSM and MPC configuration where present, deposit crediting and confirmation logic, withdrawal approval workflows and their limits, address allowlisting, and the internal transfer paths that often sit outside the main control set. Blockchain-specific issues such as chain reorganisation handling, replay exposure and token contract behaviour are assessed against the specific chains in scope.

APIs concentrate risk because they expose business logic directly, often to partners whose own security posture is unknown. Object-level and function-level authorisation flaws dominate what we find: an endpoint that checks whether you are authenticated but not whether the record belongs to you. We test against the OWASP API Security Top 10, working through broken object level authorisation, broken authentication, property-level exposure, resource consumption limits, function-level authorisation, sensitive business flow abuse, server-side request forgery, and inventory management. GraphQL scope adds introspection exposure, query depth and complexity limits, and batching abuse. Partner and machine-to-machine integrations are assessed for credential handling, token scope and replay resistance.

Compliance advisory at INLD is about closing the distance between how an organisation actually operates and what a framework requires it to evidence. We run readiness assessments against ISO/IEC 27001:2022 Annex A controls and the SOC 2 Trust Services Criteria, identify which requirements are met in practice but undocumented, which are documented but not performed, and which are genuinely absent. For regulated firms we map security obligations arising from GDPR, DORA and MiCA onto existing controls so the same evidence serves more than one obligation. We do not issue certifications and we are not a certification body; our role is to prepare an organisation so that an accredited auditor finds what they expect to find.

Training only changes behaviour when the examples are recognisable. We build sessions from the findings in your own codebase and infrastructure, anonymised where required, so developers see the actual pattern that produced the vulnerability rather than a textbook illustration. Secure coding workshops cover the vulnerability classes that appear in your stack and language, with hands-on exercises. Vulnerability awareness sessions target product, operations and support staff whose decisions create or close exposure. Incident response tabletop exercises put the response plan under pressure with a scenario drawn from the threat profile of the business — a custody incident for a digital asset firm, a payment fraud chain for a processor.