01
Exposure
Identify plausible attack paths around valuable assets and real operating dependencies.
Service / SECR
Security evidence for systems your organisation depends upon.
Root Digit helps leadership understand material exposure, helps engineering teams remove the conditions that create it and verifies whether critical controls work as intended.
02
Control
Design preventative, detective and recovery controls with named ownership.
03
Evidence
Verify implementation through review, testing and realistic response exercises.
Engineering position
Standards that govern delivery.
01
Authorised scope
Testing has explicit ownership, written authority, safety boundaries and protected evidence handling.
02
Finding quality over finding volume
Reports connect exploitability and business consequence to reproducible evidence and practical remediation.
03
Closure requires verification
A control is not treated as restored until the relevant fix or recovery path is tested.
Capability system
The work required to move from intent to operation.
Capabilities are composed around the operating problem. Each can stand alone or form part of a governed programme.
01
Security architecture
Threat-led design across applications, identity, cloud, networks and operational systems.
- Threat modelling
- Trust boundaries
- Identity architecture
- Security requirements
02
Application and platform assurance
Review and testing focused on exploitable conditions and engineering remediation.
- Code and architecture review
- Penetration testing
- API and cloud assessment
- Remediation verification
03
Detection and response readiness
Observable controls, usable playbooks and exercised recovery for material scenarios.
- Detection engineering
- Incident playbooks
- Tabletop exercises
- Recovery validation
04
Product and supply-chain security
Controls over dependencies, builds, artifacts, devices and field updates.
- Software supply chain
- Build provenance
- Device security
- Vulnerability operations
Operating application
Applied to concrete decisions.
The technology matters only when it improves a real operating path with defensible evidence.
Enterprise platforms
Critical application assurance
Test the paths that could affect identity, transactions, sensitive data or administrative authority.
Cloud & infrastructure
Control-plane security
Review identity, network, deployment and recovery boundaries across production estates.
Industrial & edge
Connected-system security
Protect device identity, firmware, remote management and OT integration without disrupting safe operation.
Leadership
Material incident readiness
Exercise decision authority, communications, containment and restoration around credible scenarios.
Delivery model
Technical depth with executive visibility.
Scope, technical decisions, risk and handover stay visible across the complete engagement.
01
Align
Define the outcome, constraints, authority and evidence required for a sound decision.
02
Architect
Design system boundaries, integration, security and the delivery path before committing to scale.
03
Deliver
Build in controlled increments and test the assumptions that carry the greatest consequence.
04
Operate
Instrument production, transfer ownership and improve the system from operating evidence.
Start with the system and consequence you need to protect.
We will help define an authorised assessment, architecture or readiness engagement around the risk that matters.