At Toreon, we support builders of digital solutions, who want to get a better grip on their cybersecurity and raise the security standards of their product, development activities, and development infrastructure.

Designed to solve software creators’ most common security business challenges, our offering consists of:

• Secure Product: Security validation of a developed product.
• Secure Development Processes: Integration of security best practices in all phases of the software development lifecycle including coaching for the developers.
• Secure Development Infrastructure: Secure configuration of cloud-native infrastructure.

Our combined expertise of AppSec, SecDevOps, Ethical Hacking & Cloud Security enables you to bootstrap your development team’s cybersecurity capacity.

We manually validate your digital product’s security in all phases of the software development lifecycle and introduce SAST/DAST tools to initiate automated code testing.

• Design Phase: Threat Modeling
• Build Phase: Static & Dynamic Code Analysis
• Test & Operation Phase: Penetration Testing

We coach your developers to become security champions and use security best practices.

Based on the OWASP SAMM (Software Assurance Maturity Model) framework, our methodology is designed to assess, formulate, and implement strategies for better software security. This framework supports the Shift Left principle–which states that in order to be truly effective, security practices should be integrated within all phases of software development making it the ultimate in combined technological and governance advice–but tailored to developers. We can also support the Shift Right principle which tests in production.

Our methodology supports security within DevOps, Agile and Waterfall software development operating models.

Being cloud-native leads to an entirely different approach to application development, deployment, and infrastructure management. The same is true for cloud infrastructure security; it requires the use of new security tactics, such as zero-trust, or it risks cannibalizing the benefits of cloud development.

We support the secure configuration of cloud native applications such as MS Azure, Kubernetes and Docker.