Services
Three disciplines, shipped in production
Information security, agentic AI and software development, delivered hands-on by CISO-level operators who build autonomous AI in production, write the software themselves and have delivered 25+ accreditations from zero to operational.
01 · Information Security
Security that holds up in production
From the board paper to the SOC queue: leadership, compliance and operations delivered hands-on by people who have run them in regulated environments.
Security Strategy & Leadership
Fractional CISO leadership, board reporting and a roadmap tied to business risk, including building a security function from the first hire.
GRC & Accreditations
Hands-on delivery of 25+ frameworks from zero to operational, including ISO 27001, SOC 2, FedRAMP High, CMMC, DORA and NIS2.
Security Operations & Response
Detection, incident response and autonomous L1 and L2 triage that investigates every alert, with the evidence attached and humans making the calls.
Cloud, Identity & Zero Trust
Zero Trust across AWS, Azure and GCP, with identity rebuilt on one plane: SSO, mandatory MFA and just-in-time privileged access.
Vulnerability & Threat Management
Risk-based vulnerability prioritisation and STRIDE threat modelling on demand, so engineering fixes what is genuinely exploitable first.
Posture & Assurance
Measured improvement, not a paper exercise: posture scored against NIST CSF, audits rehearsed in advance and evidence generated by the systems.
02 · Agentic AI
Autonomous agents you can defend
We run agent fleets in production, so the guardrails, identity and human-in-the-loop boundaries come from what has actually worked, not a framework nobody has operated.
AI Strategy & Use-Case Selection
Find where agents earn their keep and where they do not, with a risk-ranked shortlist leadership can approve and engineers can build.
Agent Design & Build
Production agents built end to end on one rule: agents investigate, reason and draft, while humans commit, approve and release.
Guardrails & Agent Identity
Scoped credentials, per-action logging and clear boundaries for what an agent may do alone and what it must hand back.
Adversarial Testing
Attack your own agents before someone else does: prompt injection, data exfiltration and tool misuse tested against your real integrations.
AI Governance & Compliance
A working governance model aligned to ISO 42001 and the EU AI Act, written for the use cases you actually run.
LLM Platforms & Cost Engineering
Model routing across frontier and self-hosted models with cost and quality telemetry, built to cut spend and ride out provider outages.
03 · Software Development
The build, not just the advice
Software delivered inside your repositories, secure by construction and handed over with tests and runbooks, so what we build is yours to run.
Secure Platform Engineering
Platforms and internal tools built in your repositories, secure by construction and handed over with tests, documentation and runbooks.
Security Automation
Detection and response pipelines that act without a human in the path: breached-credential resets, automated blocking and remediation.
Systems Integration
The connective layer between your business and IT systems, with credentials scoped per integration and evidence captured for every action.
DevSecOps & Secure Delivery
Security wired into the pipeline: code and dependency scanning, threat modelling and tested remediation pull requests rather than tickets.
Compliance as Code
Controls that run themselves and evidence generated by the systems, so audits draw on records instead of screenshots.
Embedded Delivery & Handover
We work alongside your engineers in your own stack, then hand over cleanly with no lock-in and nothing left as a black box.
How we work
From a conversation to working software
A free 15-minute call to talk through your situation, where you are and where you want to be, and whether and how we can help. Nothing is priced on this page because the work depends on what you need.
A free intro call
Fifteen minutes to talk through your situation. No pitch, no preparation and nothing to sign.
A written proposal
If there is a fit, you get a scoped proposal with the deliverables and the price agreed before any work starts, signed in our secure client portal.
Delivery in your stack
Hands-on work alongside your team, ending in written output and working software you can run without us.
FAQ
Common questions
Is the intro call really free?+
Yes. It is 15 minutes, free and with no obligation. We use it to understand your situation and tell you honestly whether and how we can help, including when the answer is that you do not need us.
Is the call confidential?+
We treat what you tell us as confidential, and you do not have to sign anything to book. If you want a mutual NDA in place before we speak, ask and we will agree one first (see Mutual NDA under Legal in the footer). It applies automatically to anything shared through our client portal.
How is the work priced?+
After the intro call we scope the work and send a written proposal, with the price agreed before anything starts. There are no open-ended day rates.
Which framework should we target?+
It depends on your customers, regulators and sales pipeline, and it is a good use of the intro call. We have delivered ISO 27001, ISO 27017, ISO 27018, ISO 42001, SOC 2, Cyber Essentials, FedRAMP High, CMMC, DoD IL2/IL4, DORA, NIS2, PCI DSS and GDPR programmes from zero to operational.
Can you help us build agents like yours?+
Yes. We design the guardrail and human-in-the-loop model, then build the agents with you in your repositories, aligned to ISO 42001 and the EU AI Act where that matters to your customers or regulators.
Do you write software, or only advise on it?+
We write it. Agents, security automation, internal platforms and the integrations behind them are delivered in your stack, in your repositories, with identity, guardrails, logging and evidence built in - then handed over with documentation, runbooks and tests. No lock-in and no black boxes.
Do you work with startups or only enterprises?+
Both. Startups get senior guidance without a full-time hire, and larger organisations get programmes scoped to enterprise scale.
Work with FeatherON
Bring in a team that ships
Book a free 15-minute call to talk through where you are and where you want to be - agentic AI risk, a compliance wall, a build that has stalled, or a board that needs answers. No pitch and no preparation, just an honest view on fit and next steps.