Expertise for intelligent, secure software
We research, design and deliver production systems. Four practices, one through-line: the software has to work, be governable, and be defensible.
AI-First Development
Most teams now use AI to write software. Few can still explain, govern or secure what got built.
We treat AI as how we develop — coding agents, applied AI in the product, and architecture that both humans and agents can follow. The aim is not more output. It is software you can inspect, operate and change.
Typical work
-
Production AI applications: agents, RAG, workflow automation
-
AI-assisted delivery of conventional systems, with declared architecture and controls
-
Taking a promising prototype into something that can run in production
ISO & Governance
Effective AI and information systems need accountability, not a policy document that never meets the architecture.
We connect governance to what the system actually does: roles, risk, lifecycle controls, and technical evidence.
ISO/IEC 42001 — AI management: governance frameworks, AI risk, human oversight, and controls across the AI lifecycle.
ISO 27001-aligned — mapping access, logging, change, suppliers and data handling to control thinking an auditor will recognise.
We help you become ready. We do not issue certificates, and we will not pretend a workshop is a certified management system.
Typical work
-
42001 readiness: gap, controls, evidence trail
-
AI governance that security and engineering can actually run
-
Control mapping from a live system into 27001-oriented evidence
Systems Development
This is the work of designing and building the platforms organisations run: APIs, data, integrations, cloud, the operational life after launch.
It is product-company and public-sector delivery — from first release through scale — not a slide deck about “digital transformation”.
Typical work
-
New product or platform: architecture through working software
-
An existing estate that has to be made coherent and operable
-
Cloud platforms that are secure enough to grow on
Cloud architecture, platform modernisation, distributed systems, serverless and automation belong here. They are how systems get built, not a separate service brand.
Systems Security
Security should be a property of the design. Trust boundaries, identity, data, integrations, and the failure modes that appear when AI systems get tools and access.
Typical work
-
Security architecture and architecture reviews
-
Threat modelling
-
Secure development practice
-
Cloud security and AI-specific security (excessive agency, prompt injection, unsafe tool use)
We design and harden systems. If you need a penetration test as a product, that is a different kind of firm.
