nandsec

Services

We analyse and test your environments, and design and build secure software, systems and infrastructure.

Hover a block on the chip to see which service it stands for.

Penetration Testing Penetration testing of web applications, APIs, cloud infrastructure, networks, mobile applications, wireless networks and thick clients. 10 services Security Architecture and Advisory We analyse your organisation's attack surface, design domain-specific threat models and build a secure architecture. 12 services AI and Agent Security We secure the AI coding tools and agents your organisation uses, and test their attack surfaces, such as prompt injection through untrusted input, excessive tool permissions and data leakage. 5 services Red Teaming and Forensics nandsec performs red and purple team engagements that simulate attacks against your organisation, to test what your defences detect and stop. We also perform forensic and malware analysis when you suspect a breach. 4 services Embedded and Firmware Security Firmware, kernel and driver security testing for embedded devices and Linux platforms. 5 services Security Engineering Secure computing environments: hardened Linux systems and workstations, Secure Boot, secure CI/CD pipelines, and remediation of findings from testing. 6 services Software Design and Engineering nandsec is focused on full-stack and systems programming, which enables us to build secure software using Rust, Go, Python, TypeScript and C. 7 services Applied Research nandsec is focused on security research in different domains, such as operating system security, memory safety, malware, firmware and AI agents. 3 services

Where most clients start

If you are not sure which service fits, these are common starting points.

Small and mid-sized businesses Endpoint and network security reviews, then internal and external penetration testing.
Teams adopting AI coding tools A secure AI development setup and a review of the AI tools in use, then testing of any agents you build.
Companies with AI-built applications An AI-built application assessment and API testing, with a retest once fixes are applied.
Software product teams Threat modelling and web application and API penetration testing, with a retest and a letter of assessment.
Teams building a new product Architecture and MVP planning, full-stack development, and a penetration test prior to release.
Device manufacturers Embedded device and firmware testing, a Linux platform review where applicable, and a vulnerability disclosure program.
In-house security teams A purple team exercise, followed by a red team engagement focused on the gaps it identifies.
After a suspected breach A compromise assessment and forensic analysis, including malware analysis of any samples recovered.