Locations · Pakistan · United States · Remote
Where engagements are delivered.
On site from Pakistan and the United States. Remote everywhere else, scheduled to your working hours: between the two offices we cover North American, European, Gulf and Asian business days without anyone waiting overnight for an answer.
Countries · 42
Pakistan
An ISO/IEC 27001 certified practice, founded in Karachi, testing for banks, fintechs and software houses across Pakistan.
US entity, Sheridan, WyomingUnited States
A US entity registered in Sheridan, Wyoming, SOC 2, PCI DSS, HIPAA and NYDFS-driven testing on US business hours.
CountryQatar
Testing for Qatari banks, government-adjacent entities and the platforms serving them, under the NIA framework.
CountryUAE & Dubai
Testing for UAE entities under IAS, DESC, CBUAE and the free-zone data protection regimes.
CountrySaudi Arabia
Testing mapped to NCA ECC and the SAMA framework, the two documents that drive most Saudi security spend.
CountryKuwait
Testing for Kuwaiti banks, government suppliers and the platforms serving them, mapped to CITRA and CBK requirements.
CountryBahrain
Testing for Bahraini banks, fintechs and cloud-first platforms, aligned to the CBB Rulebook and PDPL.
CountryOman
Testing for Omani banks, utilities and government suppliers, aligned to OCERT and CBO expectations.
CountrySingapore
Testing for Singapore fintech, SaaS and financial institutions under MAS TRM and the Cybersecurity Act.
CountryIndonesia
Testing for Indonesian banks, payment providers and platforms under POJK 11/2022 and the UU PDP.
CountryAustralia
Testing for Australian financial institutions, SaaS platforms and critical infrastructure under CPS 234 and the SOCI Act.
CountryNew Zealand
Testing for New Zealand financial institutions, SaaS platforms and public sector suppliers under the Privacy Act 2020 and NZISM.
CountryCanada
Testing for Canadian financial institutions, SaaS platforms and healthcare providers under OSFI B-13 and PIPEDA.
CountrySouth Africa
Testing for South African banks, insurers and platforms under POPIA, SARB directives and PCI DSS.
CountryKenya
Testing for Kenyan banks, mobile money operators and fintech platforms under the Data Protection Act and CBK guidance.
CountryNigeria
Testing for Nigerian banks, fintechs and payment providers under the CBN framework and the NDPA 2023.
CountryGermany
Testing for German banks, industrial operators and SaaS platforms under BSI IT-Grundschutz, KRITIS and NIS2.
CountryNetherlands
Testing for Dutch banks, fintech and SaaS platforms under DNB expectations, TIBER and NIS2.
CountryIreland
Testing for Irish financial services, SaaS and the EU headquarters of international technology companies.
CountrySwitzerland
Testing for Swiss banks, wealth managers and platforms under FINMA Circular 2023/1 and the revised FADP.
CountryUnited Kingdom
Remote delivery for UK teams, Article 32 evidence, enterprise-buyer attestation, covered from both offices.
CountryFrance
Testing for French banks, defence and aerospace suppliers and luxury groups under CNIL, ANSSI, the LPM and DORA.
CountrySpain
Testing for Spanish banks, tourism platforms and telecoms under the AEPD, INCIBE, the ENS and DORA.
CountryItaly
Testing for Italian manufacturers, fashion houses and banks under the Garante, the ACN and the national cyber perimeter.
CountryBelgium
Testing for Belgian institutions, finance and Port of Antwerp logistics under the CCB, CyberFundamentals and NIS2.
CountrySweden
Testing for Swedish fintech, telecoms, gaming and industrials under IMY, MSB, Finansinspektionen and DORA.
CountryPoland
Testing for Polish software houses, SaaS and banks under UODO, NASK, the KNF and export-driven compliance.
CountryDenmark
Testing for Danish shipping, pharma, fintech and public services under Datatilsynet, the CFCS and NIS2.
CountryNorway
Testing for Norwegian oil, gas and energy, maritime and finance under Datatilsynet, the NSM and Finanstilsynet.
CountryAustria
Testing for Austrian banks, industrials and CEE regional headquarters under the DSB, the NIS framework and DORA.
CountryPortugal
Testing for the Lisbon and Porto tech hub, outsourcing and tourism under the CNPD, the CNCS and the Banco de Portugal.
CountryMalaysia
Testing for Malaysian banks, Islamic finance institutions and shared services centres under Bank Negara RMiT and the PDPA 2010.
CountryPhilippines
Testing for Philippine banks, e-money issuers and outsourcing providers under BSP circulars and the Data Privacy Act of 2012.
CountryThailand
Testing for Thai banks, e-commerce platforms and automotive manufacturers under the Bank of Thailand, the SEC and the PDPA.
CountryVietnam
Testing for Vietnamese fintech, manufacturers and software outsourcing firms under the Cybersecurity Law and Decree 13/2023.
CountryIndia
Testing for Indian banks, fintech and SaaS at scale under the RBI framework, the CERT-In directive and the DPDP Act 2023.
CountryJapan
Testing for Japanese enterprise, financial institutions and manufacturers under the APPI, the FSA and PCI DSS.
CountryHong Kong
Testing for Hong Kong banks, asset managers and fintech under the HKMA C-RAF, the SFC and the PDPO.
CountryEgypt
Testing for Egyptian banks and a fast-growing fintech sector under the Central Bank of Egypt and the Personal Data Protection Law.
CountryMorocco
Testing for Moroccan banks, offshoring providers and manufacturers under Law 09-08, the DGSSI and Bank Al-Maghrib.
CountryGhana
Testing for Ghanaian mobile money operators and fintech under the Cybersecurity Act 2020, the Data Protection Act 2012 and the Bank of Ghana.
CountryTanzania
Testing for Tanzanian banks, mobile money operators and telecoms under the Personal Data Protection Act 2022, the Bank of Tanzania and the TCRA.
Cities · 16
All three are in Pakistan, where the head office is. On-site work runs from Karachi.
Karachi
Founded here in 2018: testing for the banks, payment providers and logistics platforms headquartered in the city.
CityLahore
Built for the software houses and SaaS products whose overseas buyers ask for a test report.
CityIslamabad
For the government, telecom and enterprise environments where the network matters as much as the application.
CityNew York City
NYDFS Part 500 driven testing for the banks, funds, fintechs and media platforms headquartered in the city.
CitySan Francisco Bay Area
SOC 2 and CPRA driven testing for the SaaS companies, startups and cloud-native platforms of the Bay Area.
CityLos Angeles
Testing across LA media, aerospace and defence, healthcare and logistics, from CMMC readiness to CCPA obligations.
CityChicago
Testing for Chicago trading, insurance and manufacturing, with BIPA statutory-damages exposure front of mind.
CityAustin
Testing for Austin semiconductors, hardware, SaaS and relocated tech HQs under the Texas Data Privacy and Security Act.
CitySeattle
Cloud-native and retail-scale testing in Seattle, with the Washington My Health My Data Act in scope.
CityBoston
Testing for Boston biotech, pharma, digital health and universities under 201 CMR 17.00 and FDA premarket cyber.
CityMiami
Testing for Miami fintech and crypto, LatAm-facing platforms, hospitality and healthcare under the Florida Digital Bill of Rights.
CityWashington, D.C.
Testing for federal agencies and contractors around FedRAMP, CMMC and the NIST 800-53 and 800-171 control sets.
CityDubai
Testing for Dubai free-zone finance and tech under the DIFC Data Protection Law, the DFSA and the DESC ISR standard.
CityAbu Dhabi
Testing for Abu Dhabi financial free-zone firms and for energy and critical infrastructure under ADGM, the FSRA and NESA.
CityRiyadh
Testing for Riyadh finance under the SAMA framework and for the NCA ECC-1 controls, Saudi PDPL and Vision 2030 projects.
CityDoha
Testing for Doha banks under Qatar Central Bank rules and for the NCSA NIA standard and the Qatar PDPPL.
Regions · 5
Middle East & GCC
One practice across the six GCC markets, with findings mapped to whichever national framework applies to you.
RegionAsia
One practice covering South Asia and Southeast Asia: same methodology, same team, in your timezone.
RegionAfrica
Testing across South Africa, Kenya and Nigeria, where mobile money and instant payments carry the risk that card fraud carries elsewhere.
RegionEurope & EU
GDPR Article 32, NIS2 and DORA: the three documents driving European testing budgets.
US entity, Sheridan, WyomingNorth America
Delivered by our own US-based team across the United States and Canada, on your business hours.
Remote engagements are delivered worldwide. Current coverage includes Pakistan, United States, Canada, United Kingdom, European Union, Qatar, United Arab Emirates, Saudi Arabia, Kuwait, Bahrain, Oman, Singapore, New Zealand, Australia, South Africa, Kenya, Nigeria.
Somewhere else entirely?
Remote delivery works in any timezone with a few hours of overlap. Tell us where you are and when you need it.