Do you work with South African government and public-sector bodies?

Yes. We provide independent security testing, code and vendor audits, and detection engineering for government departments, municipalities, state-owned entities and other public-sector organisations, remotely and on-site across South Africa.

Is the work aligned with POPIA and public-sector procurement?

Engagements are scoped in writing with clear rules of engagement, authorization sign-off and plain-language reporting suitable for accounting officers and auditors. Testing of systems processing personal information is handled with POPIA obligations in mind.

Can you assess a vendor product before we procure it?

Yes. Independent black-box and white-box vendor product reviews end in a clear go/no-go recommendation, so procurement decisions rest on evidence rather than vendor marketing.

Do you offer fixed-scope, fixed-price engagements?

Yes. Scope, deliverables and price are agreed in writing before any work begins, which suits public-sector budgeting and approval processes.

// government & public sector · South Africa

Cybersecurity for Government.

Independent, evidence-based security for South African government departments, municipalities, state-owned entities and public-sector agencies. Fixed scope, written authorization, plain-language reporting your accounting officers and auditors can actually use.

Discuss an engagement All services

// why an independent specialist

Evidence, not assurances

Public-sector systems hold citizen data and run critical services, and they are tested constantly by people who were never invited. An independent assessment tells you what an attacker can actually reach — before they do — in language a non-technical decision-maker can sign off on.

Every engagement is scoped and authorized in writing, carried out against agreed rules of engagement, and delivered as a report that states findings, impact and remediation plainly. Where systems process personal information, the work is handled with POPIA obligations in mind.

// what we do for the public sector

Services built for government

Penetration testing

Authorized, fixed-scope testing of web applications, networks and infrastructure, with a report and one round of retesting after fixes.

Vendor product review

Independent black-box and white-box assessment of a product or appliance before procurement — ending in a clear go/no-go.

Code & OSS audits

Manual, security-focused source review of in-house and open-source systems: logic flaws, auth bypasses, injection and supply-chain risk.

Detection & SOC build-out

We design, build, tune and hand over a Wazuh/Elastic monitoring stack and DFIR automation — documented and yours to run.

POPIA-aware scoping

Engagements scoped with data-protection obligations in mind, with written authorization and chain-of-custody where evidence is handled.

Plain-language reporting

Findings written for accounting officers and auditors, not just engineers — severity, impact and a remediation path.

// how we engage

Built for public-sector procurement

Fixed scope, fixed price — deliverables and cost agreed in writing before any work begins, to suit budgeting and approval.
Written authorization — a signed rules-of-engagement record for every test; nothing is touched outside the agreed scope.
Remote & on-site — across South Africa, with on-site work where the engagement requires it.
A named engineer — you deal directly with the person doing the work, not an account layer.

Discuss an engagement

// questions

Common questions

Public sector?: We work with departments, municipalities, state-owned entities and agencies — remote and on-site across South Africa.
POPIA?: Engagements are scoped with data-protection obligations in mind, authorized in writing, with chain-of-custody where evidence is handled.
Procurement?: Fixed scope, fixed price, agreed in writing up front — suited to public-sector budgeting and sign-off.
Vendor review?: Independent assessment of a product before you buy it, ending in a clear go/no-go recommendation.