Johannesburg · South Africa, UK and Europe
Most security firms hand over a findings report and leave. We write the report, then ship the remediation as infrastructure code your team reviews and merges.
Who we are
A two-person consultancy. Every engagement is delivered by the people you meet, so there is no pyramid, no junior bench and no handover after the sale.
We pair sixteen years of security assessment and incident response across Europe, the Middle East, Africa and Asia Pacific with a decade of production platform engineering at AWS, BMW, Absa and Discovery. One of us has run the assessment. The other has run the estate being assessed.
What our consultants hold
Members of the IITPSA and (ISC)². These are held by our individual consultants. SNS Labs is not itself a CREST member company or a PCI SSC Qualified Security Assessor Company.
What we do
The list is short on purpose. These are the four we can deliver to the standard we would want applied to our own systems.
CIS Benchmarks · AWS FSBP
A two-week review of your AWS, Azure or Kubernetes estate through read-only access. Evidence-driven rather than interview-driven, so it runs without occupying your team.
Optional hardening sprint: we ship the fixes as pull requests.
PCI DSS v4.0.1
The future-dated requirements became mandatory on 31 March 2025, and the ones causing most pain are engineering problems rather than policy ones. We assess the gap and build the controls that close it.
We deliver readiness assessment and remediation. Formal ROC sign-off is carried out by a partner QSA Company.
Delivered on site or remote
Practitioner-led sessions built from live incident casework and current production engineering, using code and breaches we have actually worked on.
POPIA · ISO 27001 · NIST CSF
Where you actually stand against the standard that applies to you, and a sequenced plan to close the distance.
How it runs
We stay on for the half that actually changes your risk.
Read-only access, evidence over interviews, findings ranked by what an attacker could actually reach. Mapped to whichever standard you are held to.
The part most consultancies leave to you. We implement the fixes ourselves as reviewable infrastructure code, inside your pipeline and your change process.
Posture drifts back within months unless something holds it. We re-review on a cadence and train the team that owns the estate day to day.
How we work
Fixed scope and a fixed fee, agreed in writing before anything starts. Senior people on every engagement, because there are only senior people.
Two clients at a time, so nobody waits behind somebody else’s deadline. We work across South Africa and remotely into the UK and Europe, where our consultants spent the first decade of their careers. And we will tell you when the honest answer is that you don’t need us yet.
Get in touch
If we are not the right fit we will say so, and point you at someone who is.
info@snslabs.io