Know exactly who you’re dealing with

Twenty-five years across IT and security

The judgement behind this practice was built across both at once: infrastructure, networks, systems, operations, support, software and cloud on one side, and breaking into them since 2003 on the other. That is why the advice is usable. Plenty of security reports are technically correct and operationally impossible, telling an organisation to replace a line-of-business application three departments depend on without any apparent awareness that somebody has to implement it on Monday. We have been on the receiving end of that report, which changes what you write.

Both sides of the fence

The experience here spans offensive testing, defensive and blue team operations, and audit and assurance. Most people in this industry pick one and stay there, and it shows: testers who have never run a security operations centre over-rate findings nobody could realistically exploit, and auditors who have never tested accept a control because it is documented rather than because it works. It is also why the certification work here is unusual. Your Cyber Essentials assessment is marked by someone who spends the rest of the week getting past exactly the controls being claimed.

Still testing, not just talking about it

Everyone who tests for Solusec is still testing. Daly Whyte holds over 500 accepted bug bounty findings and tests on the invitation-only Synack Red Team, where he has found severe issues that other providers and automated scanners had missed, was invited to the Masterclass finals of the UK Cyber Security Challenge, and is a registered Practitioner in Security Testing with the UK Cyber Security Council. The point is not the numbers. This field moves quickly enough that a consultant who stopped testing three years ago is giving you advice from a world that no longer exists.

Real security, not just a pass

We are not here to just get you through an audit or a test. We are here to help you become genuinely more secure and more resilient.

A certificate you scraped through does not make you safer. It makes the next twelve months feel safer, which is a different thing and a more dangerous one. In practice that means telling you when a scope is too narrow to be worth certifying, when a test would be premature because the obvious things are not done yet, and when the honest answer is that you do not need what you came in asking for.

Senior-led, and what that costs

Every engagement is delivered personally rather than handed down. No sales team translating your requirements badly, and no junior analyst running a scanner and reformatting the output into a report somebody else signs. The trade-off is real and worth being open about: it caps how much work can run at once. Occasionally that means a date we cannot meet, and we say so at the first conversation rather than three weeks in.

Independent by design

We do not act as your IT team and we do not implement the controls we then assess. That is structural rather than squeamish. An assessor who also sells you the remediation has an interest in finding some, and an interest in signing off their own work afterwards. Keeping those apart is the only reason the certificate means anything to the client or insurer who asked for it. We make the same commitment in writing to the IT providers who introduce us: we do not approach their clients, during the engagement or afterwards.

Who we work with

Schools, colleges, universities and multi-academy trusts, where we are a BESA LaunchPad member. Defence supply chain manufacturers working to Def Stan 05-138 and DCC. Law firms, accountancy practices and financial services businesses answering client security questionnaires. Manufacturers and SaaS providers certifying for a contract. And IT providers who want a security partner that will not compete with them. The common thread is that somebody there has decided doing this properly is worth more than doing it cheaply.

Where we work

Solusec is based at Albrighton in Shropshire, between Wolverhampton and Telford. Certification work is mostly remote. On-site work is routine across the West Midlands, Shropshire, Staffordshire, Greater Manchester and North Wales, and we work across the UK and internationally in Ireland, Gibraltar, Malta and Spain.

Certified and accredited

Solusec is CREST accredited, holds the CREST AI-Enabled Penetration Testing accreditation, and is a Certification Body for Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance and Defence Cyber Certification Level 0. At individual level the practice holds CREST registration, IASME Lead Assessor status for Cyber Essentials Plus, certified IASME assessor status for both schemes, DCC Level 0 assessor status, and UK Cyber Security Council registration as a Practitioner in Security Testing.

Every one of those is on a public register, and the full list with the register you can verify each one on is published here. If a provider will not show you that page, it is worth asking why.

Common questions

Daly WhyteFounder, Solusec · Albrighton, Shropshire