Annual Assurance
Annual Assurance Programme
Ongoing, structured validation aligned to your delivery cadence. Moves from snapshot testing to predictable cycles with clear outcomes and owners.
Built for engineering and procurement review.
Who it's for
Teams needing predictable, defensible assurance.
- Regulated organisations needing evidence throughout the year.
- Teams shipping frequently that want testing aligned to release cycles.
- SOC and engineering teams wanting validation with clear fix paths.
- Leaders seeking predictable cadence and cost.
What it covers
Coverage across applications, infrastructure, and people.
- Applications & APIs: web, mobile, API, and endpoint testing aligned to releases.
- Infrastructure & cloud: external/internal networks, cloud posture, wireless, and exposure.
- Identity & access paths: cloud/AD abuse routes, privilege boundaries, segmentation.
- Adversary simulation / Purple Team: threat-led scenarios to exercise detection and response.
- Social engineering (optional): authorised helpdesk/process testing and phishing campaigns.
- Detection validation: SIEM/EDR/cloud logging efficacy checked against real behaviours.
- Compliance-aligned validation: PCI, CPS 234, ISO, NPPA as required.
- OSINT and exposure monitoring: external footprint and brand signals reviewed.
Three pillars
Visibility, Validation, Uplift.
Visibility
Rolling posture insight across perimeter, cloud identity, applications, and exposure with a set cadence.
Validation
Prove controls work: MFA enforcement, segmentation, privilege boundaries, EDR/SIEM detections.
Uplift
Retest windows, remediation workshops, and defender/developer sessions to reduce recurrence.
How it runs
Lifecycle with accountable owners.
1. Programme initiation
Objectives, scope, roles, and calendar agreed.
2. Recurring cycles
Testing aligned to release windows across app, infra, identity, and adversary.
3. Reporting & retest
Evidence-led findings with prioritised fixes; targeted verification on high/critical included.
4. Annual review
Trend analysis and next-year alignment.
What you receive
Concrete artefacts every cycle.
- Findings with reproducible evidence and prioritised fix actions.
- Retest notes and closure evidence pack.
- Quarterly assurance summary with trends.
- Executive-ready summary for governance/procurement.
- Compliance mapping available (PCI, CPS 234, ISO, NPPA, Essential Eight).
Clear boundaries
What this programme is not.
- Not MDR or SOC outsourcing.
- Not generic scanning-as-a-service.
- Not a compliance tick-box without validation.
Ready to scope an assurance programme?
- Systems and environments in scope.
- Delivery cadence and change windows.
- Constraints, approvals, and stakeholders.