Security consultancy · founder-led
Security built in layers, around the way you already work.
For companies that need to pass an audit, clear an enterprise security review, harden their cloud or detect threats, without building a full in-house team. Working with clients in the US, East Africa and beyond.
What we do
Three layers, one system.
Governance defines the controls. Engineering builds them into the systems you run. Operations shows they hold. Engage one layer on its own, or all three.
A crack that gets past one layer meets the next, and turns aside. What operations learns flows back into the controls.
Governance, risk and compliance
Risk assessments, policies and compliance programmes for the frameworks your customers and regulators ask for, such as SOC 2, ISO 27001 or NIST CSF. The evidence comes from the controls themselves, so audit season stops being a spreadsheet hunt.
YOU HOLDRisk register, policies your team can follow, a control map per framework, evidence from live systems
Security engineering
Cloud security, identity and access, logging and telemetry, infrastructure-as-code guardrails and security automation. Built into the systems you already run, with your tools or ones we recommend.
YOU HOLDA baseline report per account, guardrails merged as code, a logging coverage map, runbooks for your engineers
Security operations
Detection engineering, response playbooks and agentic SecOps. AI agents gather context and write the summary; a person approves every containment action. We build it and hand it over, run it with your team, or operate alongside you in stated hours.
YOU HOLDDetections with test cases, response playbooks, investigation records, a monthly evidence pack
AI security and governance. Guardrails and evaluation for the models and agents you build, so they act within the limits you set. A growing part of our work.
We layer around your shape.
Nacre does not choose the shape of its shell. It forms against whatever surface it lines, and it is strongest where it fits most closely.
We start from your organisation, your systems and the tools you already run, then add layers where they are needed. Scope, pace and the frameworks you answer to all follow you. Some things never move.
OPERATE
Audit readiness programme
Ready for a SOC 2 or ISO 27001 audit, with evidence drawn from controls that run every day.
- LAYERS
- Define + Build
- TYPICAL
- 8 to 12 weeks
- TOOLS
- Yours, or ones we recommend
Adjustable. We shape scope and pace with you on the call.
Book a scoping call →We are new, so we show our work instead of logos.
Before you sign, you can read our written method, see a redacted sample deliverable and get a fixed scope and cost in writing.
Ask for the sample deliverableWhat we hold ourselves to, and how you can check.
Layered
No control is trusted alone.
YOU CAN CHECKYour control map names the second control behind every critical one.
Calm
Measured language and plain reporting.
YOU CAN CHECKReports give severity in words and numbers. Nothing depends on a red light.
Evident
Every claim we make can be proven.
YOU CAN CHECKEach deliverable ships with its configuration exports, logs, test results and sign-offs.
Resilient
Stronger after an incident, not just restored.
YOU CAN CHECKEvery incident closes with a written record of the change we made and the test behind it.
Who you work with
Founder-led. The person who scopes your work is the person who builds it.
Nacrion is led by an engineer who has worked in every layer of a security programme. That means writing the policy and mapping the controls, building the cloud and identity guardrails, then running the detections that show they hold. One person can follow a gap from the audit finding to the fix to the evidence.
More about Nacrion