Contact
Services

Practical help with AI, cloud security and compliance.

Every engagement is scoped with you and quoted in full before work starts. Exploits Bay is a small, senior practice, so we take on a limited number of engagements at a time and will tell you up front if our timing doesn’t suit yours.

01

Claude Code & MCP

Put Claude Code and the Model Context Protocol (MCP) to work on real problems, with the guardrails your security team expects.

What you get

  • Claude Code set-up for development teams: project instructions, skills, hooks and permission settings
  • MCP servers that connect Claude to your own systems and data, read-only by default
  • Secure hosting for remote MCP servers: Entra ID sign-in, stateless deployment, security checks in CI
  • Guardrails for agents: least privilege, prompt-injection defence, cost controls and an acceptable-use policy
Good fit for
Teams that want AI productivity without creating a new security finding.
02

Cloud Security

Azure and AWS security architecture built on least privilege, segmentation and defence in depth.

What you get

  • Landing zones and policy initiatives
  • Defender for Cloud and Sentinel; GuardDuty and Security Hub
  • Identity and access review, network segmentation, logging and monitoring
  • A prioritized list of fixes, explained in plain language
Good fit for
Organizations moving workloads to the cloud, or tidying up after moving fast.
03

Compliance Readiness

Prepare for CPCSC, ITSP.10.171, NIST SP 800-53 or CIS benchmarks using evidence from your live environment, not a spreadsheet.

What you get

  • CPCSC Level 1: read-only scan, gap report and a drafted self-assessment for your official to review
  • CPCSC Level 2 preparation ahead of third-party assessment
  • Gap assessments and remediation roadmaps against ITSG-33, NIST SP 800-53 and CIS
  • Help keeping evidence current between assessments
Good fit for
Defence suppliers and other organizations facing a contract or audit requirement.
04

DevSecOps & Supply Chain

Security checks that run on every commit, not once a year.

What you get

  • Static and dynamic analysis, dependency, container and infrastructure-as-code scanning in CI/CD
  • Software bills of materials (SBOMs) and dependency risk management
  • Secretless deployment with OIDC and verified build artifacts
  • Vulnerability triage using exploited-in-the-wild data such as CISA KEV
Good fit for
Software teams selling into government or regulated industries.

What we don’t do

We’re a small firm and we stay focused. If you need one of these, we’ll gladly point you to someone who does it well.

  • 24/7 security operations centre (SOC) monitoring
  • Standalone penetration testing
  • CPCSC certification or assessment. Assessors must stay independent of the firms that prepared you, so we stay on the readiness side.

Not sure which of these you need?

Start with a free conversation. You’ll come away knowing what applies to you and what it would take, whether or not you hire us.

Start a conversation Other ways to reach us