Services: security architecture
Designed for how your firm actually runs.
First-principles architecture for enterprise, cloud and critical infrastructure. If a control needs forty pages to explain, it's the wrong control.
Most architectures are copied, not designed.
Vendor reference diagrams, the last consultant’s template, whatever the incumbent already sold you: stitched together over a decade, until nobody can draw the whole estate on one page and every project fights security at the end instead of building on it from the start.
Good architecture is a small set of deliberate decisions that everything else can rely on. We draw those decisions, then stay to see them built.
If you can’t draw it, you can’t defend it.
What we draw
The one-page estate
Your systems, trust boundaries and real weak points on a single page: the drawing every incident, audit and project should start from.
Zero trust, sized to fit
Identity-first access and segmentation, sequenced so the business keeps running. No platform team required.
Cloud guardrails
Landing zones and identity models that make the secure path the easy one, so teams move faster rather than slower.
IT/OT boundaries
IEC 62443 zones and conduits, Purdue-model pragmatism: critical infrastructure drawn by people who’ve worked both sides of the fence.
Design authority
A standing architecture function for firms too small to staff one: reviewing designs, setting patterns, keeping projects honest.
Frameworks come after the design, not before it.
We map every design to the standards your auditors and regulators expect, after it’s been built for your firm. An architecture drawn from a compliance matrix defends the matrix; one drawn from how you actually operate defends the business.
And because what gets built is rarely exactly what was drawn, we stay through delivery as design authority, so exceptions are decisions rather than surprises.
The standards we work with: IEC 62443 and the Purdue model, NIST CSF, ISO 27001, DORA, the NCSC CAF, and zero trust.
Where we’re usually called in
- Nobody can draw the whole estate on one page any more.
- A cloud migration needs guardrails in place before teams start to move.
- An IT/OT boundary has to stand up to a NIS2 or CAF assessment.
- Projects keep hitting security at the end and need a standing design authority.
What we have written about this
The 40-page control document is a confession.
Length isn't rigour. When a control takes forty pages to explain, the document isn't describing it — it's hiding the fact that nobody ever agreed what it was for.
The defender's OODA loop is broken (and what to do about it).
Time-to-exploit has collapsed from 771 days to hours, and AI has tilted the curve further. Patching faster isn't a game defenders can win. Five plays for a 'decoupled battlespace' where containment runs at minutes while patching runs at weeks.
Orchestrating AI agents.
Networks of AI agents are about to get as tangled as microservices did — and we already know how that story went. The case for an orchestration layer that does for agents what the service mesh did for services, before the mess sets.