-
TPXIMPACT LIMITED
TPXimpact delivers production-ready software through Private and Public Beta phases. We provide full-stack development, Secure-by-Design architecture, and CI/CD automation. We ensure GDS Service Standard compliance, WCAG 2.2 accessibility, and Service Transition planning. We focus on scalability, resilience, and technical debt management to ensure a seamless Live launch
-
INSIGHT DIRECT (UK) LTD
Comprehensive security quality assurance and rigorous testing for organisations operating in the cloud, designed to proactively identify, assess, and mitigate security risks to ensure robust protection and compliance.
-
LEARNINGMATE SOLUTIONS (UK) LIMITED
We provide a range of IT-enabled services that use niche technologies and business processes to deliver quality learning solutions in the education and corporate sectors. Combining technology and content, we offer consulting, product and application engineering, automation, application transformation, implementation, product and application support, mobility, data analytics, cloud, and DevSysOps.
-
ARCANUM INFORMATION SECURITY LIMITED
Internal Infrastructure Testing evaluates the security of internal networks, systems and services, identifying vulnerabilities that could be exploited by malicious insiders/threat actors with internal access. The assessment provides comprehensive remediation guidance to strengthen defence-in-depth and improve organisational resilience across core business systems. Testing is conducted by our NCSC-Assured CHECK team.
-
BRIDEWELL CONSULTING LIMITED
Gain insight into how capable your employees are at recognising and responding to social engineering and whether your organisation’s existing policies are effective at stopping these threats. Reveal vulnerabilities by exploiting employees' natural helpfulness, helping to identify and address security weaknesses.
-
NCC Group Security Services Limited
Container security consultancy ensures robust protection for containerised environments and orchestration platforms like Kubernetes or OpenShift. Through configuration reviews, penetration testing, and breakout assessments, we identify vulnerabilities and hardening opportunities. Delivered by expert consultants, this service safeguards cloud or on-prem clusters, supporting secure CI/CD workflows and resilient microservices and architectures.
-
Northcoders Limited t/a Counter
Northcoders (t/a Counter) provides comprehensive cyber security support by embedding specialist SOC, threat, and risk analysts within client teams. Our Cyber Security service handles information security, penetration testing, and security-by-design, offering a scalable Cyber Security "try-before-you-buy" model that alleviates threats while building long-term internal technical resilience.
-
IBM UNITED KINGDOM LIMITED
IBM provides services that can uncover critical vulnerabilities that attackers might leverage against your organisation. Our X-Force Red team uses proprietary and industry standards (CHECK, CREST, ISO) to assess applications, networks, cloud, AI, IT/OT environments and more. Our actionable recommendations allow you to take actions to improve security.
-
HITACHI SOLUTIONS EUROPE LTD
Design and build simple, accessible web portals that follow GOV.UK patterns and the Government Service Standard. We deliver user research, service design, content design and development, with Web Content Accessibility Guidelines (WCAG) 2.2 Level AA compliance. Includes security, hosting, integrations, testing and live service support.
-
BRIDEWELL CONSULTING LIMITED
Formal assurance that your organisation’s external systems are protected from unauthorised access or change.
Extending the security assurance of the PSN service, an ITHC provides assurance that your systems are not providing additional risk to connected systems. Bridewell’s experts will provide testing and reporting in line with set security standards.
-
JUMPSEC LIMITED
Security assessment of iOS and Android applications and their supporting services to identify insecure storage, transport issues, authentication flaws and business logic abuse.
-
JUMPSEC LIMITED
CHECK and CREST-certified testers assess corporate and guest wireless networks to identify weak encryption, rogue access points and opportunities for unauthorised access to internal systems.
-
FULLPROXY LIMITED
Penetration testing is a vital first line of defence for anyone managing a website. It replicates the actions a hacker would take to try to penetrate your cyber defences and shows you where the vulnerabilities lie. FullProxy provide a range of advanced and affordable options from one-off to continuous testing.
-
JUMPSEC LIMITED
Controlled attempt to gain unauthorised physical access to offices, plants or server rooms to evaluate badge controls, visitor processes and on-site response.
-
3B DATA SECURITY LTD
We deliver advanced Red Teaming engagements that emulate real-world attack scenarios to assess your organisation’s resilience against sophisticated threats. Our holistic approach combines OSINT, phishing, internal compromise, and privilege escalation to identify weaknesses in technical controls and staff awareness. The outcome helps to strengthen detection, response, and overall security posture.
-
BRIDEWELL CONSULTING LIMITED
Bridewell Phishing Assessments follow the same process as a real-life phishing campaign to provide an accurate simulation of how your policies, procedures and people would respond to an attack.
-
JUMPSEC LIMITED
Attack simulation against cloud-hosted infrastructure and services (IaaS / PaaS) to identify exploitable configuration weaknesses, exposed services and insecure identity or key management.
-
JUMPSEC LIMITED
Assume-breach assessment of the internal corporate network. Our CHECK and CREST-certified consultants act as hostile insiders to escalate privileges, move laterally, and reach sensitive systems, highlighting the actual blast radius of a single compromise.
-
JUMPSEC LIMITED
CHECK and CREST-certified testers simulate real-world attacks against your internet-facing infrastructure to identify exploitable vulnerabilities, demonstrate business impact, and provide clear remediation guidance.
-
3B DATA SECURITY LTD
We provide expert vulnerability scanning using Nessus to identify weaknesses across networks, servers, and applications. Our service delivers detailed risk analysis, prioritised remediation guidance, and compliance assurance to help organisations strengthen security posture and protect against evolving cyber threats
-
MTI TECHNOLOGY LIMITED
MTI have experienced security consultants that help shape strategy, risk regimes, policies and training to secure public services. Our teams build integrated solutions from the worlds leading security vendors. Microsoft, Cisco, CyberArk, Forcepoint, Thales, Ivanti, Palo Alto Networks, AT&T, Trend, Varonis, VMware, Forescout, Rubrik, Quest and Manage Engine.
-
SECARMA LIMITED
Adversary Simulation replicates the behaviours, techniques, and objectives of real-world threat actors to show how they would operate inside your environment. Rather than focusing on isolated vulnerabilities, it evaluates how well your organisation detects, responds to, and contains malicious activity.
-
SECARMA LIMITED
Our Red Team uses a controlled and covert approach, often known only to a select group within the organisation, to mirror the tactics, techniques, and procedures (TTPs) of real threat actors. We go beyond technical vulnerabilities to challenge your processes, people, and technologies.
-
COGNISYS GROUP LIMITED
Cognisys provides comprehensive API pentest to assess weaknesses in application programming interfaces and enable system integration. Our CREST-accredited testers identify vulnerabilities in API implementations, configurations, and authentication. Assessments evaluate threat exposure, breach likelihood, and impact on data security. Detailed reports include prioritised remediation and mitigation guidance supporting secure API deployment
-
ZOONOU LIMITED
Zoonou provides quality assurance (QA) for public sector teams covering accessibility, cyber security, software testing, automation, AI assurance, and system migrations and integrations. Our services ensure secure, reliable, and inclusive digital services that meet operational, GDPR, WCAG, PSBAR, and GDS Service assessments while reducing risk, improving quality, and accelerating delivery.
-
PROCTOR AND STEVENSON LIMITED
We provide end-to-end security services for Wordpress, covering strategy, risk management, secure design, incident response, audit support and security testing. Our approach embeds security into delivery and operations, reducing risk, supporting compliance, and ensuring services remain resilient, auditable and secure throughout their lifecycle.
-
PROCTOR AND STEVENSON LIMITED
We provide end-to-end Webflow security services covering strategy, risk management, secure design, incident response, audit support and security testing. Our approach embeds security into delivery and operations, reducing risk, supporting compliance, and ensuring services remain resilient, auditable and secure throughout their lifecycle.
-
PROCTOR AND STEVENSON LIMITED
We provide end-to-end Drupal security services covering strategy, risk management, secure design, incident response, audit support and security testing. Our approach embeds security into delivery and operations, reducing risk, supporting compliance, and ensuring services remain resilient, auditable and secure throughout their lifecycle.
-
ISHELP.CO.UK LIMITED
Provides independent, risk-based testing to identify vulnerabilities, assess exploitability, and validate the effectiveness of security controls across Defence and Government IT environments.
Tailored to the buyer’s operational context, system criticality, and risk appetite, ranging from baseline compliance assessments through to advanced, threat-informed testing to provide repeatable, evidence-rich, assurance focused outputs.
-
GOACO GROUP LTD
Software development life cycle (SSDLC) includes planning, design, build, release, maintenance and updates, replacement and retirement. Secure SDLC builds on this, incorporating security in all stages of the software development lifecycle. We implement SSDLC when transitioning to DevSecOps, applying best-practices alongside functional aspects of development and securing the development environment.