Launch is a beginning, not an ending

Applications change. Dependencies age. New vulnerabilities are disclosed in software you rely on. Features get added quickly — sometimes by AI tools, sometimes under pressure.

Ongoing assurance gives you continued, experienced attention: someone who already understands your application, keeps an eye on what affects it, and helps you make sound decisions as it grows.

We're shaping these arrangements with early clients so they reflect what small and medium-sized businesses actually need. The building blocks are described below; we'll agree the right combination with you.

Building blocks

What ongoing assurance can include

These are different kinds of activity with different limits. We describe each one precisely, and we never present one as another.

Activity	What it involves	Its limits
Automated monitoring	Scheduled checks of availability and SSL/TLS certificate status for agreed public addresses.	Detects specific, predefined conditions only. It does not assess how secure your application is.
Dependency and vulnerability intelligence	Tracking newly published vulnerabilities (CVEs) and actively exploited ones listed in CISA's Known Exploited Vulnerabilities catalogue, against the frameworks and components you use.	Depends on an accurate, current list of your components. Not every vulnerability affects every use of a component.
Configuration assessment	Periodic review of hosting, DNS, certificates, security headers, environments and cloud settings.	Reviews configuration as observed at the time; changes made between reviews may not be seen.
Periodic manual review	An experienced look at what has changed in your application since the last review, and at earlier findings.	Scoped to agreed areas and access. Not a complete re-review unless agreed.
Advisory sessions	Regular conversations about plans, risks, new features and technology choices.	Advice and guidance; implementation is separate unless agreed.

Authenticated application testing and formal penetration testing are separate, explicitly authorized engagements — they are not part of routine assurance unless specifically agreed.

Also part of the relationship

Guidance when a newly disclosed vulnerability affects your technology stack
Follow-up on previously identified findings, and confirmation of fixes
Short risk summaries written for owners and managers
A second opinion before significant changes, migrations or new integrations

What we don't claim

This is not a 24/7 security operations service. We don't offer round-the-clock human monitoring or guaranteed instant incident response. Any automated checks will be described exactly — including how alerts reach us and when they're reviewed.

Any testing of your systems — automated or manual — happens only within a defined scope, with your written authorization.

Questions about ongoing assurance

Is this 24/7 monitoring?

No. Ongoing assurance is an experienced, periodic review and advisory relationship — not a round-the-clock operations centre. Where automated checks are part of an arrangement, we'll explain exactly what they cover and how alerts are handled.

Can I start with ongoing assurance without a review first?

We usually recommend starting with an independent review. It gives us — and you — a clear baseline, so later check-ins can focus on what has changed and what still needs attention.

Is ongoing assurance available now?

We're shaping ongoing arrangements with early clients, based on what their applications actually need. If you're interested, get in touch and we'll discuss what would be useful for you.

Ongoing Application Assurance