SERVICE / 01

Move security reviews forward.

Clear, defensible answers when a customer questionnaire, SOC 2 request, or evidence review is holding up a deal.

Typical engagement: 1–2 weeks

Discuss this engagement Prepare a scope brief ↗

Have a particular question about this work?

Explore a guide and refine the focus ↗

WHO IT IS FOR

For technology companies facing an enterprise security review without a dedicated owner for the response.

A rushed answer creates more questions. A vague answer erodes trust. The work is to find what is true, document the evidence, and explain gaps without overstating the program.

THE WORK

From question to evidence.

Review the request, existing controls, and available evidence.
Draft accurate responses and identify claims that need stronger support.
Prioritize the gaps most likely to delay approval or recur in the next review.
Support the conversation with the customer security team when needed.

WHAT YOU TAKE AWAY

A completed response, an organized evidence trail, a reusable answer library, and a focused list of fixes.

AN EXAMPLE OF THE OUTPUT

Explore the deliverable.

Compare engagements ↗

ILLUSTRATIVE SAMPLE / FICTIONAL ENGAGEMENT

Customer-review response

Turn a broad security claim into a supported answer.

Question or test: Customer asks: “Is privileged production access reviewed regularly?”
Response or finding: Access reviews run quarterly. The latest review covered the production administrator group and recorded owner sign-off. Service identities are tracked separately; their review is still in progress.
Evidence and consequence: A dated access export, review record, approval, and removal ticket support the human-access claim. The service-identity gap is recorded rather than hidden.

Follow-up and reusable answer

Next action: Assign an owner to finish the service-identity review and agree on how to communicate that gap to the customer.
Reusable record: Keep the approved answer with its evidence date, scope, owner, and review date so the next response can be checked before reuse.

ILLUSTRATIVE SAMPLE / FICTIONAL ENGAGEMENT

Validation finding

A revoked service credential still reaches a production API.

Fictional validation report with test, observation, fix, and verification sections. — Fictional document mockupView full size ↗

Question or test: Test: revoke a designated test credential, then repeat its previously permitted API request.
Response or finding: The identity service records the credential as revoked, but the API continues accepting it through a cached authorization result.
Evidence and consequence: The revocation timestamp and repeatable request/response show a gap between the identity state and the API’s enforcement. The report records the tested window and affected endpoint.

Fix and verification plan

Fix: Align API authorization and cache invalidation with credential revocation. Assign the change to the relevant application and identity owners.
Retest: Repeat the same revocation sequence and check the affected API. Confirm revoked access is rejected and an authorized credential still works.

ILLUSTRATIVE SAMPLE / FICTIONAL ENGAGEMENT

AI application test report

A support assistant returns another tenant’s document.

Fictional AI security report describing a cross-tenant retrieval test and retest. — Fictional document mockupView full size ↗

Question or test: Test: use an account in tenant A to request a test document belonging to tenant B through the assistant’s search tool.
Response or finding: The tool returns tenant B’s test document. The application checks login but does not enforce tenant access on the retrieved document.
Evidence and consequence: A signed-in customer could read another customer’s information through the support workflow. The finding records the test identities, retrieval path, and observed boundary failure.

Fix and verification plan

Fix: Enforce authorization on every tool request and returned document using the authenticated user and tenant. Keep that check outside the model.
Retest: Repeat the cross-tenant request with the original account and alternate inputs. Confirm unauthorized content is withheld and permitted searches still work.

ILLUSTRATIVE SAMPLE / FICTIONAL ENGAGEMENT

Leadership roadmap

Give the next quarter three owned security decisions.

Fictional security roadmap with three priorities and accountable owners. — Fictional document mockupView full size ↗

Question or test: Decision: prioritize customer-facing security commitments alongside a growing product team’s existing work.
Response or finding: Start with three priorities: ownership of customer-review evidence, the production-access review, and the AI launch decision. Record an accountable owner and the evidence each decision needs.
Evidence and consequence: The roadmap connects each priority to a business decision, a control owner, and a check-in date. Unresolved assumptions remain visible rather than being presented as completed work.

Ownership and decision rhythm

Action record: For each priority, record the owner, next action, evidence required, dependencies, and the decision date agreed with the team.
Leadership update: Use a regular review to show what changed, what remains blocked, and which decision needs leadership attention. Adjust priorities as the business changes.

PRACTICAL QUESTIONS

Before we begin.

Prepare a scope brief ↗

What should we bring to the first conversation?

The review request, its deadline, and the answers that are hardest to support. Start with a summary; sensitive documents can wait until the engagement is scoped.

What if a control has no supporting evidence?

The response should identify what is known and what remains unsupported. The work includes finding evidence gaps and prioritizing fixes, rather than overstating the program.

Can we reuse the work for the next review?

The deliverables include a reusable answer library and organized evidence. Answers still need checking against current controls and the new customer’s request.

How long does an engagement take?

A typical engagement is 1–2 weeks. The request, evidence availability, and customer deadline determine the agreed scope and timing.

NEXT STEP

Talk through the scope.

Share the situation and the decision it needs to support.

Email Piton ↗

Move security reviews forward.

For technology companies facing an enterprise security review without a dedicated owner for the response.

From question to evidence.

A completed response, an organized evidence trail, a reusable answer library, and a focused list of fixes.

Explore the deliverable.

Turn a broad security claim into a supported answer.

A revoked service credential still reaches a production API.

A support assistant returns another tenant’s document.

Give the next quarter three owned security decisions.

Before we begin.

Talk through the scope.

Privacy preferences

Question counts