Manual, expert-led security reviews for SaaS founders and early-stage tech teams. Find the vulnerabilities before your customers — or attackers — do. Fixed-scope packages, clear pricing, and remediation guidance you can act on immediately. Built for teams shipping an MVP, preparing for launch, or earning customer trust.
I am an offensive security practitioner and published researcher based in London. Brighouse Security Labs is built for startups: small teams that need real security expertise but can't afford — and don't need — a six-figure enterprise consulting engagement.
I run every review personally. That means the person testing your product is also the person scoping it, writing the report, and answering your engineering team's questions. No account managers, no handoffs, no junior analysts doing the work under a senior's name.
My background covers web application security, API testing, authentication and authorisation flaws, and cloud exposure — the areas that actually matter for early-stage SaaS. I also publish peer-reviewed research through the University of East London, so the methodology behind the work is documented and defensible, not just claimed.
Four focused offers designed around what early-stage teams actually need: manual expert-led reviews, fast turnaround, clear pricing, and remediation you can act on before your next release. No sprawling enterprise engagements. No inflated issue counts. Just the work that moves your product forward safely — with a free verification retest included on every engagement.
I work with small tech teams that need real security expertise — but don't have the budget, the time, or the need for a massive enterprise engagement. If you're shipping something early-stage and want to do it safely, this is for you.
If you're a Fortune 500 with a 500-person AD environment and a 12-month compliance programme, I'm probably not the right partner for you. My focus is on startups and small SaaS teams that want fast, expert-led reviews without enterprise consulting fees.
Most security consultancies are built for big corporate buyers — long timelines, long contracts, long invoices. BSL is built the other way around: for founders who need real answers fast, at a price that makes sense for early-stage teams.
You get a single expert who scopes, tests, and reports the whole engagement personally. That means no account managers, no handoffs to junior analysts, and no enterprise consulting markup. Just honest, technically credible security work shaped around how startups actually operate.
Rather than testimonials, here is exactly what every engagement produces — so you know precisely what you're buying before you commit. Each deliverable is tangible, reviewable, and included in the fixed scope.
Clear, prioritised findings with severity ratings, reproduction steps, and business impact. Written so your engineers can verify each issue in minutes — no consultant required to translate it.
Concrete remediation steps your developers can act on immediately — often down to the code-level suggestion. Designed so small teams can close issues quickly, without research or guesswork.
Free validation of your fixes once remediation is complete. Confirms the issues are actually resolved — useful to show investors, customers, or enterprise prospects during due diligence.
Results explained in practical business terms alongside the technical detail. A short summary your co-founder, investor, or non-technical stakeholder can read without needing a security background.
A signed, written scope agreed before any work begins. You know the price, the timeline, and exactly what is being tested — no hourly surprises, no scope creep, no enterprise contract complexity.
Testing follows OWASP WSTG and PTES, grounded in peer-reviewed research published via the University of East London. The approach is documented and defensible — not just stated expertise.
Sample deliverables available on request · get a fixed quote
A lightweight five-phase workflow applied consistently across every startup engagement. You know what to expect at each step, what you'll get at the end, and roughly when — before any work begins.
Designed to be useful: a short summary your co-founder or investor can read, and a technical write-up your engineers can act on directly.
The tooling stack used on startup engagements — focused on the things that actually break early-stage SaaS products. Scanners are used as a starting point, never the deliverable.
Peer-reviewed research published via the University of East London on machine-learning-based intrusion detection and adversarial robustness. Included here as evidence of research-backed methodology — the same rigour applied to every startup review.
↗ Sample Pentest Report · GitHubA public example of how findings are presented in an engagement report: clear reproduction steps, prioritised severity, and practical remediation guidance. Useful if you want to see exactly what you'll receive before booking a review.
Answers to the questions startup founders ask most often when they're considering their first real security review.
Still have questions? Every engagement starts with a no-obligation 20–30 minute call. Use the form below to get in touch — I respond within 24 hours.
Share a few details and I'll reply within 24 hours with a recommended review, a fixed-scope quote, and a realistic timeline. No obligation, no enterprise sales process — and if your situation doesn't need a full engagement yet, I'll tell you that too.
What happens next: I reply within 24 hours with a recommended package and a fixed-scope quote. If you'd like a quick call first, we can schedule 20–30 minutes. No commitment required, no minimum spend, no enterprise contract complexity.