Six disciplines that close different gaps in the same exposure
Cybersecurity
Cybersecurity gets requested as one purchase and delivered as six different disciplines, each built to close a problem the others cannot reach. A penetration test proves nothing about SOC 2 readiness, and a compliance audit rarely surfaces the exploitable bug a tester would find in an afternoon. This practice starts by naming which discipline the exposure actually needs, before any tool runs or any report gets scoped.
Why the discipline gets chosen before the engagement
How a stated exposure gets matched to one of six security disciplines.
90 secSample frame · video pending01Locate the gap
Which exposure are you actually holding?
A buyer usually arrives worried about security in the abstract and leaves needing one specific thing done. Pick the situation nearest yours below and the discipline built to address it surfaces, with the reasoning stated rather than assumed.
Partners or your own frontend call endpoints nobody has formally tested against real attack patterns.API security tests the contract layer directly against the OWASP API Top 10, rather than the wider application.
A recurring defect reaches production release after release because nothing catches it earlier in the pipeline.Application security builds scanning and secure coding practice into the development lifecycle itself, not a one-off check.
IAM policy, storage exposure and network segmentation grew without a dedicated review as the environment scaled.Cloud security reviews infrastructure and configuration specifically, separate from anything sitting inside the application code.
SOC 2, ISO, HIPAA or GDPR has moved from an aspiration to a customer contract requiring evidence.Compliance consulting is governance and evidence work, closer to policy documentation than to technical testing.
Automated scanners keep coming back clean, but nobody has tried to break in the way a motivated attacker would.Penetration testing is a bounded, adversarial engagement with a defined scope, an exploitation attempt and a fixed end date.
Policy, configuration and control gaps need documenting across a whole estate before anyone commits to a remediation budget.A security audit reviews policy and configuration broadly and ranks the findings, without the exploitation attempt a penetration test performs.
Two vendors have already proposed different things, and the gap between an audit and a penetration test is not obvious from outside.A penetration test proves what breaks under attack. An audit documents everything against a standard, breakable or not.
API Security
Testing the contract layer against the OWASP API Top 10, authentication and rate limiting.
Application Security
Scanning, threat modelling and secure coding built into how your team ships code.
Cloud Security
IAM, network segmentation and configuration review across your cloud infrastructure.
Compliance Consulting
Gap assessment, policy documentation and evidence collection toward SOC 2, ISO or HIPAA.
Penetration Testing
A time-boxed offensive engagement simulating a real attacker against an agreed scope.
Security Audits
A broader review of policy and configuration, delivered as one ranked report.
02Before any tool runs
The same four steps precede every engagement
Every cybersecurity engagement here starts from the same discipline, regardless of which of the six it ends up matching. A vague worry gets translated into a specific, answerable question before a scanner ever runs or an auditor asks for evidence. That translation is what tells the buyer exactly what they are paying to learn.
Name the exposure precisely
A general worry about being secure gets translated into a specific question: a code defect, a misconfiguration, an unproven assumption about resilience, or a documentation gap ahead of a deadline.
Before a tool or auditor gets involvedMatch the exposure to a discipline
The named exposure points to exactly one of the six disciplines above, occasionally two when a compliance deadline and an untested assumption arrive together.
One discipline, not a bundle by defaultScope a bounded engagement
Systems in scope, the standard being tested against and the artefact due at the end all get written down before the first billable hour.
Fixed before work starts, not renegotiated mid-wayHand over evidence, not a slide deck
Every engagement here ends in a written artefact, a report, a decision document or an audit trail, built to survive scrutiny weeks after the work finishes.
Something a reviewer can act on immediately
03Evidence and proof
Exposure named correctly before any tool ran.
Cybersecurity proof is the right discipline chosen the first time, not a retrofit after the wrong one was tried. These previews carry that bar while written client approvals are secured.
Explore case studiesA fintech control gap closed before the next audit cycle.
Vela Ledger's compliance team flagged a control gap ahead of a SOC 2 renewal with limited internal capacity to fix it. A scoped remediation closed the gap and the evidence held through the following review.
- Control gaps open at renewal
- Zero
- Time to remediation evidence
- Four weeks
A healthcare platform ranked its exposure before spending a cent.
Koru Health suspected several gaps across its stack with no ranked view of which mattered most. An initial review sorted every finding by exploitability and pointed the first budget at the right discipline.
- Findings ranked by exploitability
- 38
- Budget redirected to the top risk
- Confirmed
We thought we needed a penetration test. The actual gap was a compliance one, and they said so before taking the work.
Sample · pending client approval
04Pick the pressure you feel most
Four common starting points into this practice
Most cybersecurity engagements start from one of four pressures: an unproven assumption, a suspected misconfiguration, a development pipeline shipping the same defect twice, or a deadline attached to a named standard. Each path opens into the discipline built for it.
- Penetration Testing
Prove you can be breached
A time-boxed offensive engagement against an agreed scope, ending in a report a development team can act on directly.
- Cloud Security
Find the misconfiguration first
IAM, storage and network review across your cloud estate, before an attacker finds the same gap on their own schedule.
- Application Security
Build security into how you ship
Scanning integrated into your pipeline for the whole application, plus focused testing of the contract layer for anything exposed as an API.
- Compliance Consulting
Get ready for an audit already on the calendar
Governance and evidence work toward a named standard, backed by a technical review where the auditor expects one.
05Straight answers
Asked before a discipline gets chosen.
01How do I know which cybersecurity service I actually need?
Start from the exposure rather than a service name. A recurring code defect points to application security, a misconfigured cloud points to cloud security, and an upcoming audit points to compliance consulting. Naming the gap usually settles it in one conversation.
02What is the difference between a penetration test and a security audit?
A penetration test is adversarial: testers try to exploit an agreed scope and report what actually broke. A security audit reviews policy and configuration more broadly and ranks the findings without attempting exploitation.
03Is API security different from application security?
Yes. API security tests the contract layer specifically, covering authentication, rate limiting and the OWASP API Top 10. Application security is broader, covering the whole codebase across the development lifecycle, not only its endpoints.
04Do we need compliance consulting or a security audit for a SOC 2 renewal?
Compliance consulting handles the governance work: gap assessment, policy documentation and evidence collection toward the standard itself. A security audit is a technical and process review that can feed evidence into that same renewal.
05Can these services run together, or do we pick just one?
Most engagements start with one discipline and expand once the first finding points elsewhere. A cloud security review, for instance, regularly surfaces an application security gap nobody had scoped at the outset.
06What happens if a review finds something outside the agreed scope?
It gets reported clearly as out of scope, with a recommendation on which discipline should look at it next. Scope stays fixed for the current engagement, so cost and timeline never shift midway through it.
07How long does a typical cybersecurity engagement take?
It depends entirely on the discipline chosen. A focused API security test can close in two to three weeks, while a full security audit across a large estate runs considerably longer.
08What does work across these six disciplines cost?
Each discipline prices independently from its own scoping call, because a compliance gap assessment and a penetration test carry entirely different effort. Naming the exposure first keeps the quote matched to the actual problem, not the costliest discipline on offer.