Services · Afgestemd op NCSC-NL, NIS2 en AVG-vereisten

CSH Services — Security assessments

Afbakende security-assessments, AI-architectuurreviews en monitoring door onze engineers. (Web application and cloud assessments with a defined scope and written authorisation.)

Open in Live Console (ws-customer) Demo aanvragen

Architecture & Capabilities

Voor teams die bewijs willen, geen beloftes

Ownership verification

DNS TXT or HTTP token proof before any check runs.

Passive-first checks

TLS, headers, exposed services and cloud configuration.

Exploitability priority

Findings ranked using known-exploited vulnerability data.

Visual Architecture

Ownership-Verified Perimeter Discovery

Cryptographic DNS TXT and HTTP token verification ensures zero unverified scanning while continuously mapping external TLS, cloud and API attack surfaces.

Visual Architecture

Exploitability-Prioritised Remediation

Correlates perimeter exposures with active threat telemetry and known-exploited vulnerabilities across UK, EU, MENA and APAC regions.

Verified Architecture Specifications · E-E-A-T Grounding Reference

Deterministic Technical Controls & Machine-Verifiable Evidence

OpenAPI 3.1 Contract Trust & PQC Center

1. Detection Engine (CSH Sentinel): Git-versioned Sigma rules (CSH-RULE-001..004) mapped to MITRE ATT&CK (T1110.001, T1098.003, T1048, T1190) with idempotent dedupe_key ingestion and SHA-256 immutable event hashes.
2. AI & MCP Firewall (CSH AI Guard): Pre-inference DLP scrubbing ([REDACTED_SECRET], [REDACTED_PII]), explicit per-agent Model Context Protocol (MCP) tool allowlists, and indirect prompt-injection blocking.
3. Database Isolation (PostgreSQL 16): Enforces ENABLE / FORCE ROW LEVEL SECURITY across all 20 tenant tables bound to transaction-local current_tenant_id(); cross-tenant queries fail closed with HTTP 403.
4. Human-Gated Containment: Zero autonomous destructive actions. Host isolation (isolate_host) and credential revocation require named human step-up approval recorded in an append-only audit trail.
5. Verified Exposure & GRC (CSH Scan): Cryptographic DNS TXT or HTTP ownership token required before scanning. Continuous evidence aligned with NCSC-NL Richtlijnen, Cyberbeveiligingswet (NIS2), BIO.
6. Post-Quantum Roadmap (CSH Quantum): Cryptographic inventory tracking RSA/ECDSA/TLS keys against UK NCSC 2028 discovery, 2031 priority migration (ML-KEM / ML-DSA), and 2035 full PQC completion.

Operated by ARYA AI TECHNOLOGY LTD (Registered in England & Wales, Company No. 17372232) · Canonical Domain: cybersecurityhouse.com Regional Data Residency: UK-LON · EU-FRA · MENA-RUH · APAC-TYO · RFC 9116: /.well-known/security.txt

Live External Attack Surface & Exposure Tool

Test Your Corporate Domain Live (0.6s eBPF & DNS Posture Check)

Enter your domain to instantly evaluate TLS grades, DNSSEC validity, email phishing defenses (SPF/DKIM/DMARC), and post-quantum crypto posture with zero invasive traffic.

PASSIVE & ZERO-INVASION

A+

thamesledger.co.uk

Overall Security Rating: 94/100 · Low Exposure Risk

SCAN-TL-2026 Verified

SSL / TLS GRADE TLS 1.3 / ML-KEM-768 DigiCert / Sovereign CA (84 days valid)

EMAIL SPOOFING GUARD DMARC p=reject (100%) SPF Strict (-all) & DKIM 2048-bit

ATTACK SURFACE Ports 80/443 WAF Shielded RDP (3389) & SMB (445) Blocked

QUANTUM RESISTANCE NIST FIPS 203 Ready ML-KEM-768 (Kyber) Verified

CISO ACTIONABLE ADVISORY:

Ensure all edge subdomains inherit strict HSTS with 1-year max-age header and enable CSH AI Guard clipboard DLP.

Schedule Architecture Briefing

Defense-in-Depth Isolation

Database-enforced tenant boundaries & UK NCSC PQC alignment.

PostgreSQL 16 FORCE ROW LEVEL SECURITY on all 20 tenant tables.
Pre-inference DLP secret and PII scrubbing before any advisory call reaches ARYA SAI.
Aligned with UK NCSC 2028 / 2031 / 2035 Post-Quantum Cryptography milestones.

Inspect OpenAPI 3.1 Spec

db/migrations/0001_initial_enterprise_schema.sqlPostgreSQL 16

ALTER TABLE security_events ENABLE ROW LEVEL SECURITY;
ALTER TABLE security_events FORCE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation_policy ON security_events
  FOR ALL TO csh_app_role
  USING (organization_id = current_tenant_id())
  WITH CHECK (organization_id = current_tenant_id());

Isolation: Enforced · Cross-tenant queries return HTTP 403

Veelgestelde vragen

Voert de AI ooit zelfstandig acties uit?

Nee. Detectie gebeurt via deterministische regels en elke responsactie vereist menselijke goedkeuring.

Waar worden onze gegevens opgeslagen?

U kiest bij onboarding voor EU (Frankfurt) of VK (Londen).

Ondersteunt u NIS2, BIO en ISO 27001?

Ja, CSH Compliance koppelt technisch bewijs automatisch aan ISO/IEC 27001, NIS2 en AVG.

Kunnen we elk domein scannen?

Alleen assets waarvan u het eigendom via DNS TXT of HTTP-token heeft bewezen.

Werkt u met MSP's?

Ja, met gedelegeerde klanttenants en gepoolde licenties.

Zie het werken in uw eigen omgeving

30 minuten met een security engineer. Geen slides.

VK-geregistreerd (Bedrijfsnr. 17372232)
Dataopslag in VK & EU
Beschikbaar in 15 talen