Security, engineered in.
We build software and cloud platforms that are secure by design, and the monitoring technology that shows what is happening on them. Security here is engineering work with evidence, not a policy document.
- DesignThreat model, data classification, trust boundaries
- CodeReview, static analysis, dependency and secret scanning
- BuildSigned artefacts, software bill of materials, provenance
- RunLeast privilege, encrypted stores, segmented networks
- WatchTelemetry, anomaly detection, alerting, audit trail
- RecoverImmutable backups, rehearsed restores, runbooks
From threat model to audit trail.
Security decisions are cheapest at design time and most expensive after an incident. We make them early, in code, where they can be tested.
Secure software development
Threat modelling before code, static and dependency scanning in the pipeline, software bills of materials, secrets management, and reviews against the OWASP Application Security Verification Standard.
Identity and access engineering
Single sign-on with OIDC and SAML, multi-factor authentication, least-privilege roles, row-level security in the database, and key rotation.
Cloud security posture
Hardening to CIS benchmarks, encryption with managed keys, network segmentation and web application firewalls, centralised audit logging ready for a SIEM.
Monitoring and detection technology
Endpoint and network telemetry, anomaly detection, and alerting pipelines. PDTL develops this technology and runs it in its own products.
Ransomware resilience
Behavioural detection of mass file encryption, backups that damaged files cannot overwrite, and recovery rehearsals that prove data comes back.
Compliance-ready engineering
Controls and evidence mapped to ISO/IEC 27001 Annex A, the NIST Cybersecurity Framework and Cyber Essentials, produced by the pipeline rather than written up afterwards.
We build the monitoring, not just the advice.
PDTL develops endpoint and network monitoring technology and runs it in its own products: kernel-level event tracing on Windows, per-application network baselines and ransomware-aware protection around backups.
Endpoint telemetry
Process, file and network events collected at the source, with the cost of collection measured so monitoring never becomes the problem.
Network visibility
Which application talked to which destination, how much left, and when — the questions an incident actually turns on.
Anomaly detection
Baselines per application and per device, so an alert means 'this is not normal here', not 'this matched a generic rule'.
Ransomware behaviour detection
Mass-encryption patterns spotted near the data, with protective action on the backup path before good copies are overwritten.
Alerting that carries meaning
Alerts with the evidence attached, deduplicated, and routed to the person who can act — into your SIEM or ticketing system.
Evidence and audit trail
An append-only record of what was seen and what was done, retained to policy and exportable for an investigation.
Mapped to the standards you will be asked about.
Auditors, insurers and enterprise customers ask the same questions. We build so the answers already exist, with evidence produced by the pipeline.
OWASP ASVS and Top 10
Verification requirements chosen at the right level for the system, and checked in review rather than claimed in a brochure.
NIST Cybersecurity Framework
Identify, protect, detect, respond and recover used as the structure for what we build and what we hand over.
ISO/IEC 27001 Annex A
Technical controls implemented and evidenced, so your certification work starts from a system that already behaves.
Cyber Essentials
The UK baseline — patching, access control, malware protection, secure configuration and firewalls — built into the platform.
CIS Benchmarks
Cloud accounts, containers and hosts hardened to published benchmarks, drift detected automatically.
Supply chain integrity
Pinned dependencies, software bills of materials, signed artefacts and provenance, so you know what is running.
What we do not do.
Said plainly, so nobody buys the wrong thing.
- managed security operations centre (SOC) services
- penetration testing
- incident-response retainers
- 24/7 managed IT support
- antivirus software or an antivirus replacement
- ISO certification consultancy
No technology prevents every attack. Monitoring can miss a real threat and can raise a false alarm; our work is to make both rarer and to make recovery certain. Where you need a penetration test, an accredited assessor or an incident-response retainer, we will say so and work alongside the specialist you appoint.
Security is cheaper before launch.
A threat model, a hardening pass, an identity design, or monitoring built into the product you are shipping. Bring us in while it is still a decision, not an incident.