Digital Infrastructure & Cybersecurity
Security engineering for IT, cloud and operational technology
An independent team that tests, hardens, monitors and automates the systems that run your business — whether or not you operate a plant. Every engagement is scoped in writing, evidenced in the report and re-tested before we close it.
- VAPT
- Cloud security
- Identity & access
- OT / ICS security
- ISO 27001 & NIST CSF
- Incident response
- DevSecOps
- Automation & AI
Web · API · Mobile · Network · Red team
Security Testing (VAPT)
Penetration testing and vulnerability assessment that proves what is exploitable, ranks it by real business risk and tells your engineers exactly how to fix it. We combine automated scanning with manual exploitation, following OWASP methodology and a phased, scoped approach.
- Web application testingOWASP Top 10 and ASVS-based testing: injection, broken access control, authentication and session flaws, SSRF, insecure deserialisation and business-logic abuse.
- API security testingREST, GraphQL and SOAP services against the OWASP API Top 10: BOLA/IDOR, mass assignment, excessive data exposure, rate-limit and token handling.
- Mobile & thick-client testingAndroid and iOS apps and desktop clients tested against OWASP MASVS: local storage, certificate pinning, IPC and reverse-engineering resistance.
- Network & infrastructureInternal and external testing, Active Directory attack paths, credential exposure, firewall and segmentation validation, and service hardening.
- Vulnerability assessmentAuthenticated and unauthenticated scanning with Nessus, OpenVAS and Nmap, followed by manual validation to remove false positives.
- Red-team & adversary simulationScoped, objective-driven exercises that chain weaknesses the way a real attacker would, to test people, process and detection.
- Cloud-hosted workloadsTesting of AWS- and Azure-hosted applications and exposed services, including misconfiguration and secrets exposure.
- Reporting & re-testCVSS-rated findings, proof of exploit, affected assets, business impact and step-by-step fixes, with an executive summary and a re-test to confirm closure.
AWS · Microsoft Azure · CIS Benchmarks
Cloud Security
Review, design and harden cloud environments so that identity, network, data and logging controls are correct by default and stay that way.
- Posture & configuration reviewAccount and subscription review against CIS Benchmarks and provider best practice, with prioritised misconfiguration findings.
- Identity & privilegeLeast-privilege IAM roles and policies, privilege-escalation paths, service-account and access-key hygiene, and break-glass design.
- Network securityVPC / VNet design, security groups and NSGs, private connectivity, ingress and egress control, and public-exposure discovery.
- Data protectionEncryption at rest and in transit, key management, storage-bucket exposure, and backup and retention controls.
- Logging & monitoringAudit-trail coverage and alerting baselines (for example CloudTrail and Azure Monitor), log integrity and retention.
- Secrets & configuration managementRemoving hard-coded credentials, vault-based secrets, and secure CI/CD access to cloud accounts.
- Landing zones & guardrailsMulti-account structure, policy-as-code guardrails and baseline templates for new workloads.
- Enterprise systems on cloudCloud system engineering for enterprise and Oracle environments, with security built into the design.
Okta · Entra ID · SSO · MFA · JML
Identity & Access Management
Identity programmes delivered by engineers with years of hands-on Okta experience and more than 1,200 enterprise applications integrated.
- Single sign-onApplication onboarding over SAML 2.0, OpenID Connect and OAuth 2.0, including custom and legacy applications.
- Multi-factor authenticationMFA rollout and policy design: strong factors, step-up authentication and conditional access.
- Lifecycle automationJoiner-mover-leaver workflows, HR-driven provisioning, SCIM and API-based account management.
- Directory integrationOkta and Microsoft Entra ID, Active Directory synchronisation, group and attribute design, and tenant migration.
- Authorisation modelsRBAC and attribute-based access design, segregation-of-duties rules and entitlement clean-up.
- Privileged accessAdmin-account separation, just-in-time elevation and session controls for sensitive systems.
- Access reviews & certificationPeriodic recertification campaigns with evidence for audits.
- Identity security testingReview of SSO configurations, token handling and misconfigured trust relationships.
IEC 62443 · Purdue model · SCADA · PLC
OT / ICS Security
Industrial cybersecurity that respects uptime and safety: passive-first discovery, careful testing and changes planned around production windows. Delivered by the digital team with an understanding of plant operations.
- Passive asset discoveryInventory of PLCs, HMIs, drives, historians and network equipment from mirrored traffic, without active scanning of fragile devices.
- Risk assessmentThreat and vulnerability assessment using IEC 62443-3-2 concepts, with consequence-based prioritisation.
- SegmentationPurdue-model zones and conduits, IT / OT demilitarised zones and firewall rule-set review.
- Secure remote accessVendor and engineer access through jump hosts with MFA, session recording and time-boxed approvals.
- HardeningBaselines for engineering workstations, HMIs and servers; disabling unused services and ports; application allow-listing.
- Patch & vulnerability managementVendor advisory tracking and change-safe patch planning aligned to maintenance shutdowns.
- MonitoringNetwork anomaly detection and alert design for industrial protocols.
- ResilienceBackup and restore of PLC logic and configurations, and OT-specific incident-response playbooks.
ISO/IEC 27001 · NIST CSF · DPDP Act
Governance, Risk & Compliance
Turn frameworks into working controls, owned risks and evidence that stands up in an audit.
- ISO/IEC 27001 readinessISMS scope, asset and risk assessment, Statement of Applicability, policies and procedures.
- NIST CSF assessmentCurrent-state and target profiles across Identify, Protect, Detect, Respond and Recover, with a prioritised roadmap.
- Risk register & treatmentLikelihood-impact scoring, risk owners, treatment plans and tracking.
- Third-party & vendor riskQuestionnaires, evidence review, tiering and residual-risk scoring for suppliers and service providers.
- Data-protection readinessPractical alignment with India's Digital Personal Data Protection Act, 2023: data mapping, consent and breach-response processes.
- Policy & control documentationInformation-security, access, change, backup, logging and incident policies written to be used, not shelved.
- Audit supportEvidence collection, control testing and remediation tracking ahead of internal and external audits.
- Security awarenessRole-based training, including phishing awareness and OT security-and-safety briefings.
SIEM · MITRE ATT&CK · Playbooks
Detection & Incident Response
Shorten the time between something going wrong and someone knowing what to do about it.
- Logging strategyWhat to collect from endpoints, identity, network, cloud and applications, and how long to keep it.
- SIEM use-casesDetection rules and dashboards mapped to MITRE ATT&CK techniques and tuned to cut noise.
- Alert triage proceduresSeverity definitions, runbooks and escalation paths for the people who receive the alerts.
- Incident-response planningRoles, communication plans and playbooks for ransomware, credential compromise, insider misuse and data leakage.
- Tabletop exercisesScenario-based drills with management and technical teams, followed by a lessons-learned report.
- Ransomware readinessBackup isolation, recovery testing, privileged-account protection and containment procedures.
- Post-incident reviewRoot-cause analysis, evidence-preservation guidance and control improvements.
- Vulnerability managementScheduled scanning, risk-based prioritisation, remediation SLAs and reporting.
Threat modelling · SAST · DAST · SCA
Secure Software & DevSecOps
Security built into design and delivery, with engineering support from Python and backend developers on the team.
- Threat modellingSTRIDE-style design reviews, data-flow diagrams and abuse cases before code is written.
- Secure code reviewManual review of authentication, session, input-handling and data-access code paths.
- Pipeline securitySAST, DAST and software-composition analysis in CI/CD, secret scanning and dependency policy.
- Container & infrastructure-as-codeImage scanning, base-image hygiene, and review of Terraform and Kubernetes configuration.
- API securityAuthentication, authorisation, rate limiting, input validation and schema enforcement for REST services.
- Backend engineeringPython and Django back ends, REST API development and secure integration with identity providers.
- Security requirementsTranslating compliance and threat-model outcomes into testable acceptance criteria.
- Developer enablementSecure-coding workshops using your own codebase and recent findings.
n8n · RAG · LLM security · Python
Automation & AI
Practical automation and AI assistants that remove repetitive work, built on n8n and the systems you already use, with security designed in.
- n8n workflow automationApproval, alert, reporting and hand-off workflows across email, CRM, ERP, spreadsheets and chat.
- API & webhook integrationREST and webhook integrations with Oracle, SSO, Google Workspace and internal services.
- Retrieval-augmented assistantsChatbots and knowledge assistants grounded in your SOPs, manuals and policies, with document-level access control.
- Lead capture & routingEnquiries captured, scored and delivered to the right owner automatically.
- Document & report automationInvoices, MIS and compliance reports generated and filed without manual re-keying.
- LLM-application securityTesting for prompt injection, data leakage and abuse (OWASP LLM Top 10), plus input and output guardrails.
- Controls & auditHuman-approval steps, rate limits, role-based access and audit logging on every automated action.
- Dashboards & alertsPlant and business data brought into one view, with threshold-based alerts.
How an engagement runs
Scoped, evidenced and re-tested
-
Scope
Rules of engagement, asset list, threat model and success criteria agreed in writing before any testing starts.
-
Assess
Manual and automated testing, configuration and architecture review, and control-gap analysis.
-
Remediate
Findings ranked by CVSS and business risk, with hands-on help hardening and implementing the fixes.
-
Validate
An independent re-test confirms every finding is closed, and a close-out report records it.
-
Operate & train
Runbooks, monitoring baselines and training, so your team keeps the improvement.
What you receive
Reporting your engineers and your board can both use
- Executive summaryA plain-language view of risk and priorities for management, with no jargon to decode.
- Technical reportEvery finding with a CVSS score, affected assets, business impact and reproduction steps.
- EvidenceScreenshots, requests and proof of exploit, so your engineers can verify each issue themselves.
- Remediation guidanceStep-by-step fixes ordered by risk, with hands-on help where you want it.
- Re-test and close-outIndependent confirmation that each finding is closed, recorded in a close-out report.
- Debrief and handoverA walkthrough with your team, plus runbooks and monitoring baselines where relevant.
Frameworks we work to
- ISO/IEC 27001
- NIST CSF
- IEC 62443
- OWASP Top 10 & ASVS
- CIS Benchmarks
- MITRE ATT&CK
- DPDP Act 2023
Tooling and platforms
- Burp Suite
- Nessus
- OpenVAS
- Nmap
- Metasploit
- Wireshark
- Nikto
- Okta
- Microsoft Entra ID
- AWS
- Azure
- n8n
- Python
Frameworks and tools listed are those we assess against and work with. They describe our method, not a certification held by PEATS.
Frequently Asked
Questions about our digital work
No. Digital Infrastructure & Cybersecurity is an independent team that works with any organisation that runs software, cloud or identity systems. It also covers operational-technology security for plants when that is what you need.
An executive summary, the agreed scope and method, and every finding with a CVSS score, evidence or proof of exploit, affected assets, business impact and step-by-step remediation. We re-test after your fixes to confirm each finding is closed.
Scope and rules of engagement are agreed in writing first. For plant networks we use passive discovery and avoid active scanning of fragile devices. Intrusive tests run in agreed windows or against staging copies.
We review and harden AWS and Microsoft Azure environments against CIS Benchmarks, and we implement and integrate Okta and Microsoft Entra ID, including SSO over SAML 2.0 and OpenID Connect, MFA and lifecycle automation.
Yes. We run gap and risk assessments, help write and implement policies and controls, support evidence collection ahead of audits, and work with you on practical readiness for India's DPDP Act, 2023. We support your certification; PEATS itself does not issue certificates.
Book a free consultation or send an enquiry. We will scope the work, agree the rules of engagement and give you a clear plan, timeline and estimate before anything starts.