A real engineer looks at your systems before you spend anything

There's no catch and no obligation. Most people who need security or engineering help can't tell from the outside whether they need a full engagement, a small piece of work, or nothing at all, so they put off deciding. Thirty minutes of a practitioner's time answers that, and it costs us far less than writing proposals for work that was never the right fit. If you don't need us, we'll tell you so.

No. It's a technical conversation with someone who does the work. We'll tell you what we found and what we'd do about it. If a paid engagement is the right next step we'll say so and explain what it would involve, but nobody is going to push you toward one on the call.

For a security review, the domain or application you want us to look at, and confirmation that you own it or are authorised to have it assessed. For an AI or software review, a short description of what you're building or running; a repo or architecture doc helps but isn't required.

No. Submitting the form books a slot and tells us what you'd like reviewed. Nothing is scanned at that moment. The assessment is run by a person, only against systems you've told us you're authorised to have assessed, and only after you've booked.

It is a free manual review. It is not a full VAPT or penetration test, and the difference matters. A VAPT engagement is days of scoped, authorised testing against your systems, and it is paid work. This assessment is thirty minutes in which a practitioner examines what is reachable from the outside, tells you which of the OWASP Top 10 categories your stack is structurally most exposed to, and gives you a clear view of whether a full VAPT, a targeted test, or nothing at all is the right next step. If someone offers you a free penetration test, ask what they are running. It is almost always an automated scan with the output retyped.

The security track covers this. In thirty minutes we can tell you roughly where you sit against ISO 27001, what a customer security questionnaire is likely to catch you on, and which gaps are cheap to close versus which need real project work. It is not a certification audit or a formal gap assessment; those are paid engagements with evidence collection and documentation. It is enough to show you what you are walking into before you commit budget.

Yes, that is the AI and software track. A practitioner looks at the architecture you have or are planning and tells you where it will strain, whether RAG, fine-tuning, an agent, or plain automation fits your problem, and where retrieval or evaluation quality is likely to make an AI feature confidently wrong. A repo or architecture document helps but is not required; a couple of paragraphs describing the system is enough to make the call useful.

Yes. What you share is used to prepare for your assessment and nothing else. We're happy to sign an NDA before you send anything sensitive. Ask on the booking form and we'll arrange it before the call.

We'll scope the engagement properly and quote it before any work starts. The assessment carries no commitment either way, and the written summary is yours regardless of what you decide.