You and your staff are using personal devices extensively
Perhaps you have a work laptop, but often you're reaching for your personal machine when it fits your workflow, and everyone's using their own phones.
Defence & dual-use startups
Counter the most advanced threats.
If you're developing military or dual-use technology, Keose builds affordable, proportionate protection from the most advanced threats, without slowing down your engineering teams.
Being small does not mean being unnoticed. Adversaries know that today's plucky startup is tomorrow's decisive edge on the battlefield. They seek to gain early access while security is minimal, and maintain it as you grow.
Security built around how small teams really work.
If your startup is fifteen people or fewer, your priority is getting your technology working, attracting additional investment and beginning trials with potential customers. Right now, your setup probably looks a lot like the following:
Your engineers are operating at the bleeding edge
They're testing new tools, libraries and extensions on a daily basis as they push the boundaries of what's possible. They have no time or patience for their machines being centrally locked down by an MSP that doesn’t understand how fast they need to move.
The boundaries between personal and work are blurry or non existent
Project discussions happen on personal WhatsApp accounts. Drinks with friends are where deals and investments take shape, and those discussions continue on personal email. You keep track of everything using your favourite AI note taker, and trying to implement a single solution company wide would massively disrupt your workflow.
Although you do have space in a business park, you often work from home / the road.
Work happens wherever you and your team are: at test ranges, industry events and while you’re technically on ‘holiday’.
Protect today. Prepare for what comes next.
Right now, you need security that fits your current hardware, culture and workflows.
That’s where Keose comes in. Our focus is precisely on your situation. We’ll work with you to massively increase your security without disrupting your team, your workflow or your speed of development.
As customer obligations grow, you’ll need clearer separation of personal and work systems, managed devices and more standardised tools. We help you build towards those changes at a sensible pace, including Cyber Essentials Plus and relevant Defence Cyber Certification requirements in the UK, without getting ahead of what your team can support today.
The connected threat picture
Understand who may target you — and why.
From the moment you come out of stealth you’ll be on the radar of powerful threat actors.
Nation states: cyber attacks
Nation states, like all threat actors, have finite resources, and need to prioritise attacking governments, critical infrastructure, and defence primes. But they can often get into lightly defended startups with a simple piece of social engineering. The payoff might not be large right now, but nation state hackers can ‘dwell’ in that startup’s network indefinitely, waiting for the day when that access becomes important, such as when that startup sells its first product to a military client.
Nation states: human intelligence and technical surveillance
As your startup grows and improves its cyber defences, nation states will increasingly reach for two other collection strategies: human intelligence operations and ‘technical surveillance’. Human intelligence operations involve foreign intelligence officers or their proxies building relationships with your personnel, contractors, suppliers, partners - anyone who has access to your confidential data. These days, such relationships can be formed both in real life and online. ‘Technical surveillance’ involves techniques such as bugging meeting rooms, gaining physical access to servers and covertly searching offices, residences or hotel rooms. A typical defence tech startup with premises within a business park and only basic physical security measures is highly vulnerable.
The new reality: physical attack by nation states and their proxies
A few years ago the threat from foreign states stopped at espionage. Adversary states now also present a physical risk to premises and personnel, and the UK and Europe have seen attacks on critical infrastructure, defence firms and entities linked to Ukraine. Fortunately, pressure from Western security services means such attacks are usually carried out by local proxies whose capability sits well below an intelligence service’s, so simple measures genuinely reduce your exposure. And many of the same improvements that counter technical surveillance help here too.
Militant activists and ‘hacktivists’
In recent years, militant activist groups have been actively targeting defence firms. Peaceful protest is a well-established right in democracies, and ‘direct action’ that does not harm anyone or cause serious damage to property is also a well-established form of protest in countries like the UK. Recently, however, some activist groups have gone well beyond these methods.
For example, they have used lorries to ram through gates and sledgehammers to smash through doors and windows, and attack police and security guards. Less violent but still intimidating techniques have included ‘doxing’ defence firm personnel (publishing their home addresses and other personal information), and putting up posters in the area of defence firm locations showing the faces of company personnel. On the cyber side, ‘hacktivist’ groups, some broadly aligned to militant activist groups, have also been targeting the defence sector.
Competitors
Industrial espionage is much less common than some people may think, but it does happen, and the risk is higher in the defence sector. Competitors based in certain jurisdictions will often have, at minimum, the tacit endorsement of their host governments, and in some cases active support from those governments. Governments know that a strong local defence sector is a critical part of national defence, and are often willing to use state resources to help their own firms outcompete foreign rivals.
Militant and criminal groups
Transnational organised crime these days has a serious interest in acquiring defence technology, and a lot of money to invest in making that happen. They seek drones, underwater vehicles and covert communications equipment for smuggling, attacks on rivals and evading law enforcement.
Practical support
Joined-up cyber, people and physical security
Security and privacy for both you as individuals and your organisation
High-threat cyber security
We help you protect both personal and organisational systems against the most capable cyber adversaries.
Counter espionage & insider threats
Vetting new hires, onboarding and offboarding procedures, data loss prevention and espionage awareness briefings to help your team recognise if adversaries try to cultivate relationships with them.
Physical security for premises
Cost-effective measures that make it harder for adversaries to physically threaten premises or conduct technical surveillance such as bugging to compromise your IP.
Due diligence
Vet new clients, partners / alliances, investors & acquisitions. Spot red flags before they threaten your organisation.
Digital sovereignty
We tell you what sovereignty risks are in your supply chain and help you put in place proportionate measures to reduce risks without disrupting operations.
Personal security
360 degree security and privacy for you, your personnel and family members, along with improvements to residential security where required.
Travel security
Devices, information and personnel are more exposed when they travel. We provide travel briefings, a dedicated travel director to handle bookings and, if needed, on-the-ground support.
Other high-threat sectors
The same approach applies beyond defence.
Outside of the defence and dual-use sectors, if you're facing highly capable threats, we can help. Media outlets and charities researching dangerous groups. Medical research firms targeted for harassment. Small law firms and consultancies holding sensitive data of high profile clients. Tell us what concerns you and we'll give you a straightforward view on security that matches your situation.
Published thinking
A defence tech startup has a target on its back
Ed Hare on why startups should begin securing their technology before adversaries gain a quiet foothold.
A jargon-free first conversation
Start before security becomes urgent.
Tell us what you're building, how your team works and what information you handle. We'll help identify the sensible first priorities and explain the options without pressure. Whichever way you reach us, it stays confidential.
- Emailinfo@keosetech.com
- WhatsApp@keosetech
- Signal@Keose.91