Security is a property of how the team works.
Not a phase, not a checklist, not a vendor you call in the last sprint. Here is the lifecycle every Grey Ferrite engagement runs on, whether we are building, breaking, running or proving.
Model
Before design, we draw the system, mark the trust boundaries and list who would want to cross them. The threat model is a living document that changes with the architecture.
Build
Every change is reviewed by a second engineer with security sign-off. Dependencies, secrets and infrastructure are scanned in CI. Nothing merges on a green build alone.
Attack
Before a major release, engineers who did not write the code test it grey-box: source open, credentials in hand, goal to break it. Findings are fixed and retested before ship.
Prove
Threat models, test reports, control mappings and runbooks ship with the software. Your auditor gets evidence, not a meeting.
What "reviewed" means here
- Two-person rule. No change reaches a protected branch without a second engineer's approval, including the lead's own changes.
- Security sign-off. Changes touching authentication, authorization, cryptography, data handling or infrastructure require review from the application security practice.
- Reproducible builds. Pinned, signed dependencies and a software bill of materials on every release.
- Secrets never in code. Enforced in CI and verified by our own testers, because policy without a check is a suggestion.
- Decisions written down. Architecture decision records for anything we would have to explain to a new engineer or an auditor.
Three ways to work with us
A defined scope, a fixed team and a delivery date. Best for new products, migrations and compliance programs.
Grey Ferrite engineers inside your team, your tooling and your standups for a quarter or longer. Best for capacity with a security lift.
Application security, platform operations or compliance on a monthly retainer with named engineers and response targets.
Commitments we put in the contract
- One accountable engineering lead for the life of the engagement
- Weekly written status with risks named, not softened
- Your repositories, your cloud, your data; nothing lives on our side
- Fixed-price where scope is fixed; time and materials where it is not; never a surprise
- Thirty-day termination for convenience, with a clean handover
Full master services terms are summarized on the terms page and provided in full with every proposal.
Our bench, briefly
Manual testing first. Interception proxies, custom tooling, fuzzers, static and dynamic analysis as accelerators, never as the report.
Terraform and Pulumi, Kubernetes, policy-as-code, SIEM integration, infrastructure drift detection.
Continuous evidence collection wired to your identity provider, cloud accounts and CI, mapped to SOC 2, ISO 27001, NIST 800-53 and CMMC.
Want to see a real threat model?
We will walk through a redacted one from a past engagement on the first call.