How can we help?
SAFE SQUARE Service Guide
You don't have to know which service you need.
Start with any one of these three.
- ConsultationJust ask usTell us what worries you and we'll work out together what to check first. You're welcome to just talk it through before choosing a service.
- Starting pointSecurity Health CheckWithin an agreed scope, we look at your organisation's hacking and security issues from five perspectives and identify key risks and improvement priorities.
- Annual programmeCybersecurity CareWe combine the Comprehensive Security Health Check, exposure intelligence, training and expert advice to the extent you need, and keep your security management going through the year.
You can take a broad look at where your security stands, test a particular risk in depth, or bring the services you need together as one project.
We consult inEnglish · 한국어 · 日本語 · Bahasa Indonesia · Deutsch
If this sounds familiar
Similar concerns share a line. Find the one closest to your situation, or browse every service in the sitemap.
-
- We've never had a proper security review.
- A company like ours got hacked, and now our CEO is asking if we're okay.
- I've just taken over security and was handed almost no documentation.
- We've grown so fast that no one knows all our systems any more.
- We need evidence to decide where to put our time and people.
- Investors doing due diligence ask about our security, and we have nothing to show them.
- We worry former employees' accounts are still active somewhere.
How we can help
Comprehensive Security Health Check
We search like an attacker and check like a defender, and set out where you stand, what to fix first and the next steps. The check can run anywhere from half a day to several months.
-
- A major customer won't sign without an outside penetration test report.
- A client's security questionnaire asks for our external test results.
- A bid requires third-party security test results.
- We have a certification audit coming up and need external test results.
- We need proof that we fixed the vulnerabilities an audit flagged.
- After an incident, we need to show customers we've been tested again.
- The developers say everything is fixed, but we're not sure it really is.
How we can help
Security Assessment & Penetration TestingVulnerability Assessment & Penetration Testing (VAPT)
We test your systems as an independent third party and set out each problem we find in a report, with its real impact, evidence that can be checked again and how to fix it.
If a regulator or parent company requires testing under its frameworkThreat-Led Penetration Testing (TLPT)
-
- We're about to launch a new service and aren't sure it's safe to ship as it is.
- We've moved our servers to the cloud and aren't sure the settings are right.
- We've taken over a system a vendor built and don't know if we can trust it.
- Our admin page can be reached from the internet, and we're not sure that's okay.
- We've added an AI chatbot to our service and don't know what risks it brings.
- We've started managing factory equipment remotely, and we're worried about security.
- We're about to launch an IoT device and worry about how well it would stand up to hacking.
- We've shipped a big update and want the changed parts tested again.
- We've revamped our website and want to check it's safe from hacking.
How we can help
Security Assessment & Penetration TestingVulnerability Assessment & Penetration Testing (VAPT)AI System Security Assessment & Penetration TestingIndustrial Control & Hardware Security Validation
We find vulnerabilities in what you are launching or changing, from websites, apps and the cloud to AI systems, control equipment and connected devices, and confirm whether they can really be exploited and what they would mean for your business.
-
- We don't know where our customers' personal data could leak.
- We haven't fully mapped where our app, website and IoT devices send customer data.
- We think someone is gaming our coupons or points.
- We've heard a tampered copy of our app is going around.
- Many clients share our service, and we worry one could see another's data.
- Our networks are separated, but we're not sure data really can't get out.
- We worry someone about to leave could take our design files or source code with them.
- We worry ransomware would wipe out our backups along with everything else.
How we can help
Risk-Focused Security ValidationBusiness Logic & Service Abuse ValidationPrivacy Risk AnalysisRansomware Resilience ValidationNetwork Separation & Exfiltration Control Validation
We start from the harm your business and its users could suffer, and focus our testing on the conditions and paths that lead to it.
-
- Fake sites or text messages pretending to be us are going around.
- A partner got an email in our CEO's name asking for a payment.
- We want to know whether staff logins and passwords have leaked.
- We've heard our company's name came up on the dark web.
- Someone tipped us off that our customer data is being traded.
- We worry there are servers or domains open to the internet that we don't know about.
How we can help
Exposure IntelligenceAttack Surface AnalysisLeaked Information AnalysisPhishing & Impersonation Analysis
We find what can be seen of you from outside, such as exposed assets, leaked information and impersonation, and tell you whether it really concerns you and what to do first.
-
- We don't know if we'd even notice a real attack.
- We worry that one compromised laptop could spread to the whole company.
- We get a pentest every year, but real attackers would probably come in another way.
- The board is asking how well we would hold up against a real attack.
- Leadership wants a realistic test without telling the security team.
- There are attack groups going after our industry, and we don't know if we're ready.
How we can help
Objective-Based Penetration Testing & Red TeamingThreat-Led Penetration Testing (TLPT)TLPT Threat & Scenario Analysis
We go after an objective such as customer data or a core system as a real attacker would, and show the path to it and whether your organisation notices and stops the attack. It can also run as a TLPT, with scenarios built from analysis of the threats aimed at you.
-
- We have plenty of security tools but can't tell which attacks they catch and which they miss.
- Our monitoring report says ‘no issues’ every month, and we wonder if that's really true.
- So many alerts go off that we worry we'll miss the one that matters.
- If something happened, we're not sure we'd have the logs to trace it.
- We've put in new detection tools and rules and want to check they actually work.
- We want our monitoring and response teams to practise together against real attack techniques.
How we can help
Purple Teaming & Detection Exercises
The attack and defence sides practise detection and response together using real attack techniques, and fix missed detections on the spot.
-
- Our staff click links in phishing emails without a second thought.
- The security training video everyone watches each year changes nothing.
- Hardly anyone reports a suspicious email when they get one.
- We'd like our developers to reproduce the issues in vulnerability reports themselves and see why they matter.
- We need our new security hires up to speed and working fast.
- We want our security team to see our systems the way an attacker does.
- We want to run an in-house hacking contest and find hidden talent.
- We want to use AI agents in our security work but don't know how much to hand over.
How we can help
Security Capability Development for People & AISecurity Awareness TrainingOffensive Security TrainingCTF & Competition Operations
We build people's security capabilities, from your staff's habit of spotting phishing and similar tricks and reporting them straight away, to hands-on practice in attackers' methods and hacking competitions. For AI agents, we evaluate and improve how well and how safely they handle security work, as a tailored engagement.
-
- With no security staff, our head of development has ended up handling security too.
- When a security question comes up, we have no one to turn to for advice, so we search online.
- We had one security check, and nothing has happened since.
- Every time a new vulnerability is in the news, we can't tell if it affects us.
- Nobody has decided who does what if ransomware hits.
- We have to report on security to leadership regularly.
- We want to plan this year's checks and training together.
- Each time we adopt new AI or cloud services, we want to decide together what to check.
How we can help
We check your security and what's changing outside on a regular schedule, talk things through when you need to, and prepare your response through scenario practice. You can start with a Lite, Basic or Premium plan, or have an Enterprise plan designed around your organisation.
-
- Off-the-shelf security tools don't fit our environment.
- We want tools that automate our repetitive checks and report writing.
- We want AI models or agents built for our own security work.
- Our security knowledge is scattered, and we want our team and AI to be able to use it together.
How we can help
Technical collaboration and joint research
Where a problem existing tools struggle with lies in a field SAFE SQUARE researches, we build what it needs with you through technical collaboration or joint research: tools, AI models and agents, or knowledge systems your team and AI share.
-
- We know we need security, but the cost is a stretch for us.
- We're a nonprofit holding lots of donor data, with no money for security.
- We're an early-stage startup and can't afford anyone for security.
- We're a small school or community group, and expert security help is hard to get.
- We worry a single attack could bring our public-interest work to a halt.
How we can help
Selected organisations with limited means can pay part or all of the service cost forward through an agreed contribution to the community.
-
- We don't know where to start.
- Our CEO asked us to look into security, and we don't know where to begin.
- Security jargon is so hard we don't even know what to ask.
- From the service names alone, we can't tell what's different.
- Something odd happened, and we can't tell if it's even a security problem.
- We have concerns but can't quite put them into words.
How we can help
Write down whatever comes to mind, even if it isn't sorted out yet, and we'll find the right service with you.
If you'd like to find out where you stand firstComprehensive Security Health Check
Contact
Every enquiry comes to this one address.
contact@ssq.ai
What to put in your first message
It can be short. Include only what you know.
- Organisation and contact
- Your company or organisation, and who we should reply to
- What is happening
- What has happened, and what worries you
- What you want to find out
- What you want to know, or what you want to protect
Please send sensitive material, such as passwords, access keys, customer lists or vulnerability details, through the channel we give you in our reply.
In your language, close to you
Team members living in Singapore, Korea, Japan, Indonesia and Germany talk with you directly in each country's language. They know how work gets done locally, and can meet you in person when that helps.
Singapore
Let’s talk.
English
Korea
편하게 말씀해 주세요.
한국어
Japan
お気軽にご相談ください。
日本語
Indonesia
Silakan hubungi kami.
Bahasa Indonesia
Germany
Sprechen Sie uns gerne an.
Deutsch
You can also write to us by email in any other language. In-person meetings are arranged around location and schedule.