Assessments with a written scope
Every assessment starts with agreed scope and rules of engagement: which systems, which environments, which hours and who to call if something looks wrong.
Cybersecurity services in Kenya for banks, fintechs and growing businesses
Security assessments and penetration testing of web, API and mobile apps, hardening of cloud, servers and API gateways, and data protection aligned with Kenyan law.
What this practice covers
Testing your applications and APIs
Penetration testing of web, API and mobile applications, looking for the weaknesses attackers use: broken access control, injection, weak authentication and exposed data.
Hardening what you run
Secure configuration of cloud accounts, Linux and Windows servers, databases and API gateways, including WSO2 API Manager, checked against recognised hardening benchmarks.
Security built into delivery
Secure development practices for your teams: threat modelling, code review, dependency and secret scanning, and security tests in the CI pipeline.
Ready for an incident
A review of how you would detect, contain and recover from an incident: logging, backups, access, contacts and who decides what, before you need it.
Data protection in practice
Practical controls and records aligned with the Kenya Data Protection Act 2019: what personal data you hold, where it goes, who can see it and how long you keep it.
The service in this practice
Security Assessment
Vulnerability scanning, penetration testing and configuration review of your applications, APIs, servers, cloud and gateways, with findings ranked by risk.
How we can work together
Security assessment
Vulnerability scanning and a review of your applications, servers and cloud configuration, with findings ranked by risk and a remediation plan.
Penetration testing
Manual and tool-assisted testing of web, API and mobile applications within an agreed scope, followed by a retest once fixes are in.
Hardening and secure development
Secure configuration of cloud, servers and WSO2 gateways, and secure development practices built into how your teams ship.
Where security slips
Few breaches start with something clever. They start with an API that returns another customer’s records when an ID is changed, an admin route that was never meant to be public, a server still on its default configuration, or a password that a former employee still knows.
These are findable. The work is to look for them methodically, fix them in order of risk, and keep them from coming back with the next release.
What we do
- Security assessments and vulnerability scanning. Your external and internal exposure, applications, servers and cloud configuration, reviewed and ranked by risk. See security assessments.
- Penetration testing. Web, API and mobile applications tested within an agreed scope, with every finding reproducible and a retest once it is fixed.
- Secure configuration and hardening. Cloud accounts, Linux and Windows servers, databases and API gateways, including WSO2 API Manager and Micro Integrator, configured against recognised hardening benchmarks.
- Secure software development. Threat modelling, secure code review, dependency and secret scanning, and security tests in the CI pipeline, so issues are caught before release.
- Incident-readiness reviews. Logging, alerting, backups, access and the plan your team would follow, tested on paper before a real incident tests it for you.
- Data-protection practices. Practical controls aligned with Kenya’s Data Protection Act 2019: data mapping, access, retention and the records your data protection officer needs.
What you receive
What you receive depends on the scope you agree with us.
- A written scope and rules of engagement. The systems, environments, testing windows and contacts, agreed before any testing starts.
- A findings report. Every finding ranked by risk, with its evidence and a specific fix.
- A remediation plan. The fixes in order of risk, so your team knows what to close first.
- Retest results. Confirmation of which findings are closed once your fixes are in.
What is in the report
The findings report is written for both your engineers and your management. It has four parts:
- Executive summary. What was tested and the most serious risks, in plain language for your management and board.
- Scope and rules of engagement. The systems, environments and testing windows agreed, and what was not tested.
- Findings by severity. Each finding with its risk rating, the evidence that reproduces it and a specific fix.
- Retest results. Which findings are confirmed closed after your fixes, and which are still open.
Gateways and APIs
Most of the systems we see in banking and payments are now reached through APIs. We have published a payment gateway’s APIs through WSO2 API Manager, so we know where gateways are usually left open: published administrative routes, back ends that trust a header instead of a signed token, and one set of credentials shared by every caller. A gateway review checks each of these. See Integrations for how we build them.
Financial crime and fraud
Security keeps attackers out of your systems. Transaction monitoring watches what happens to the money inside them. For banks, SACCOs and payment providers the two belong together. See AML & fraud detection and IntegWatch, our financial crime intelligence product, now onboarding early-access partners.
What we will and will not say
A security assessment reduces risk; it cannot remove it. We report what we tested, what we found and what we did not test, so your board and your regulator see an honest picture. Compliance decisions stay with your institution; we give you the evidence and the fixes.
How an engagement runs
- Scope. The systems, environments, testing windows and rules of engagement, agreed in writing.
- Assess. Scanning, manual testing and configuration review within that scope, with critical issues reported to you at once.
- Report. Findings ranked by risk, with evidence and specific fixes, written for both your engineers and your management.
- Fix and retest. We help your team fix what we found, then retest to confirm it is closed.
Planning a security assessment or hardening?
Tell us which systems, APIs and gateways are in scope, and what is driving the review. We agree written scope and rules of engagement with your IT and risk teams before any testing starts.