delivery graphic

Security services: software assessment, cloud assessment and penetration testing

Brief us
sse logo jcb logo your move logo powerleague logo bosch logo dhl logo

Security work from people who build software for a living

Propel Tech is a UK software consultancy. We build bespoke systems, and we also check whether the ones you already run are safe. That means an AI-augmented security assessment of your application, a review of the AWS or Azure environment it lives in, and penetration testing when you need to see what an outsider could get to.

We are a member of the Anthropic Cyber Verification Program, which gives us access to Claude models built for this kind of defensive work, and we point them at the whole codebase rather than a sample of it. Then a security consultant goes through every finding, throws out the noise and ranks what is left by what it would actually cost you.

And because we are developers first, we can fix it.

Let’s talk tech
propel icon

We’re eager to support your bespoke software and AI project goals. Get a free consultation.

Get in touch

Here to propel your
business forward

We work with manufacturers, logistics firms, property companies, utilities and public bodies, often on software a previous supplier built. Security sits alongside our wider software development services.

allsop logo
your move logo
vanderlande logo
sse logo
wates logo
better org logo
jcb logo
ptsg logo
powerleague logo
quickline logo
group nexus logo
alexandra workwear logo

Our security services

Software security assessment

A review of your application from the inside, with full access to the source code. AI agents read the whole codebase, the infrastructure as code and every third-party dependency, looking for the usual suspects: injection, broken authentication, access control gaps, data handled carelessly, secrets in the wrong place, packages with known holes. If there is an LLM or an agent in the product we test that too, for prompt injection, data leaking through the model's context and tools with more permission than they should have.

A security consultant confirms every finding before it reaches you.

Cloud environment assessment

Your software can be solid and the AWS or Azure account around it can still be wide open. We review the environment against the CIS benchmarks and the provider's own baseline: who can access what, what is reachable from the internet, how storage and encryption are set up, where secrets live, what gets logged, whether backups would actually restore. We also compare what your infrastructure as code says with what is really deployed, because the two drift.

You get a ranked list of misconfigurations, each with its fix. We can apply them for you.

Penetration testing

A controlled attack on your live or staging system, so you know what an attacker could reach rather than what the architecture diagram says they could. We scope it to your system and your risk, whether that is external infrastructure, a web application, an API or an authenticated test from inside a user account. Rules of engagement are agreed in writing before anything starts.

Every finding comes with a severity rating, the evidence and the fix. When you have remediated, we retest and give you a letter you can hand to a customer, an insurer or an auditor.

How an engagement works

Scope first, always. Assessments run against a copy of your system in an environment we control. Penetration tests run under written rules of engagement. Nothing happens to production without you signing it off.

01

Scope and threat model

We map the system with you: the data, the users, the integrations, the cloud footprint. Then we agree where the real risk is and which of the three services you actually need.

02

Assess and test

AI-augmented scanning for the software and the cloud account. Manual and tooled testing for the pen test. Either way, the whole system gets covered.

03

Consultant review

A security consultant goes through every finding. False positives go. Real issues get confirmed, and we look at how they could be chained together into something worse.

04

Report

A summary your board can read, a findings list ranked by risk, and a technical appendix for your developers with exactly where each issue lives and what fixing it involves.

05

Fix and retest

Our developers make the fixes, or work alongside yours. Then we scan or test again to make sure they held.

Which one do you need?

People ask us this a lot, so here is how the three services and our free AI audit compare.

Software security assessment Cloud environment assessment Penetration testing Free AI audit
Looks at Application code, dependencies, APIs, AI features AWS or Azure configuration and identity A live or staging system from the outside A codebase at a high level
Access Full source code and infrastructure as code Read-only access to the cloud account Network access and test credentials, with rules of engagement Read-only view of a codebase
Finds Code-level weaknesses and insecure patterns Misconfiguration, exposure, weak identity controls What an attacker can actually reach and exploit Code quality, security hygiene, AI readiness headlines
Output Three-part report and remediation plan Ranked misconfiguration list with fixes Severity-rated findings, evidence, retest letter Short summary with next steps
Typical time Two to four weeks One to two weeks One to two weeks plus retest A few days
Fixes Propel can remediate Propel can remediate Propel can remediate Not included

The usual order is software and cloud assessments first, fix what comes up, then a pen test to prove it. If an insurer or a contract is asking for a pen test by a date, start there and we will fit the rest around it.

What you get

Whichever service you pick, the same things hold.

The whole system, read

A manual review of a large codebase samples. It has to. AI reads all of it, every file, every config, and applies the same checks throughout.

Someone who decides what matters

A consultant confirms each finding and ranks it by what it could cost you, so your remediation budget goes on the things that would hurt.

Fixes from the same people

We can do the remediation ourselves. You do not have to take a findings report to a second firm and start the explanation again.

Something to show people

Reports and retest letters written so you can send them to the enterprise customer, the insurer or the auditor who asked.

When people call us

A big customer has sent a security questionnaire

You need answers you can stand behind, and you would rather know about the gaps before they do.

You have inherited something

A previous supplier, a developer who left, a company you bought. There is a system and a cloud account and nobody can tell you whether either is safe.

You are putting AI into a product

Wiring an LLM or an agent up to live data and real tools opens routes in that a normal test would never touch.

An audit is coming

Cyber Essentials Plus, ISO 27001, a client's own assessor. You want to see what they will see first.

Your insurer wants a pen test

Or a contract does. You need it scoped properly, reported clearly and retested, ideally by someone who can also fix what turns up.

How we think about security

Security is part of building software well. We have never understood the model where a separate firm turns up at the end, hands over a PDF of findings and leaves. Our security consultants sit with the developers who build and modernise systems for our clients every day, which means the findings make sense in the context of how the thing was actually built.

AI handles the volume. A named consultant at Propel owns every finding in your report and will sit down and walk you through it.

security graphic

Why Propel Tech

A few things worth knowing about us before you decide.

We are audited against this too

Propel Tech holds Cyber Essentials Plus, ISO 27001 and ISO 9001. The controls we check your systems against are the same ones we have to pass ourselves every year.

Anthropic partner, Cyber Verification Program member

Anthropic vets organisations before letting them in. Membership gives us Claude models built for defensive security work, used under Anthropic's safeguards on how they can be applied.

One company, start to finish

Assessment, testing, fixes and retest from the same people. You will not be handed a list and left to find someone to act on it.

The planning side is covered as well

If you need the thinking before or after an assessment, our security strategy consultancy covers secure-by-design roadmaps, incident response plans, audit preparation and AI governance.

SSE PLC Case Study
Featured Case Study

A new and improved customer service portal

  • A scalable B-2-B focused web-based portal
  • Improved customer experience and customer management
  • Improved efficiency and reporting by automating services
  • Reallocation of valuable resources to be used elsewhere
  • Greater control and transparency end-2-end
Read case study
eBook

Make effortless software migration a reality! Download our essential free guide now to make successful migrations happen

Get the Ebook

Other software development services

We provide a range of software development services to propel your business forward.

Strategy:

Delivery:

Support:

Your partners in possibilities

As experts across existing and new technologies, we don’t simply solve software problems, we find solutions that help manage change so that your business thrives and grows.

We’re eager to hear about your project goals and turn them into reality. Get a free consultation to make tech possible.

Brief us

FAQ on security services

If nobody has looked at your software before, do the software assessment and the cloud assessment together. Between them they find the most for the least disruption. Pen testing makes sense once you have fixed what those turn up, or straight away if a customer, insurer or contract is specifically asking for one.

No. A pen test attacks a live system from outside, usually without seeing the code. The software assessment works from the inside with full access to source, configuration and infrastructure, so it finds a different set of problems and usually a bigger one. We do both, and plenty of clients have both done.

It reads. An entire codebase and every configuration file, in hours rather than weeks, applying the same checks to every line. What it does not have is judgement about your business, so a security consultant reviews everything it flags, drops the false positives and ranks the rest. The models come to us through the Anthropic Cyber Verification Program, which only gives vetted partners access to its security-focused models.

Yes. Everything runs in isolated environments under our ISO 27001 controls. Code is handled under NDA. Cloud access is read-only and time-limited. Only the consultants on your engagement can get at any of it, and it is all removed when we finish. We will walk you through the specifics before you share anything.

Scoping and written rules of engagement. The test itself, across whatever we agreed: external infrastructure, web application, API, authenticated. A report with severity-rated findings and the evidence behind each one. A debrief with your team. Then a retest once you have fixed things, with a letter confirming what was closed.

A software assessment of one bespoke system is usually two to four weeks from scoping to report, depending on its size and how many things it talks to. A cloud assessment or a pen test is one to two weeks, plus the retest. You get a fixed timeline at scoping.

Yes. Most of what we assess was built by someone else. Previous suppliers, in-house teams that have moved on, companies that got acquired. We are used to walking into systems cold.

Yes. It is the main reason people come to a software consultancy for this rather than a pure security firm. We can do the remediation as a follow-on piece of work, or give your own team a clear plan and retest when they are done.