What they have actually built
We examine the architecture and critical code supporting the target’s claims.
Understand the technical risk before you invest, buy, or partner.
Independent security diligence for investors, acquirers, and enterprise buyers who need to know what they would actually be taking on.
Diligence scope
What we evaluate
We check the target’s claims against available evidence and identify what remains unverified.
What they can prove
We separate demonstrated security posture (findings, fixes, incident history) from assertions with nothing behind them.
What you would inherit
We surface the vendors, platforms, and technical debt that become yours on the day the deal closes.
What we could not establish
We state the evidence gaps plainly, so an unanswered question never reads as a clean result.
Timing
Best used before you buy or commit.
Investment or acquisition
A commitment depends on the target's technical reality.
Vendor selection
A strategic platform will inherit trust and operational reach.
Ecosystem commitment
A grant or partnership needs independent validation.
Claims need evidence
Security assertions made during a deal require technical review.
Our approach
How we build the evidence for your decision.
Define the questions that could change the decision
Agree the investment, acquisition, vendor, grant, or partnership question. Identify the technical claims to check and the evidence needed to assess them.
Check claims against available evidence
Review architecture, code, controls, and incident history within the access provided. Record what supports each claim and what remains unverified.
Document red flags and open questions
Investigate the gaps with the greatest impact on the decision. Rank red flags and unresolved questions, with the evidence needed to close them.
Explain the implications
Prepare an executive summary connecting findings and remaining unknowns to the transaction or commitment under review.
What you receive
Evidence you can take into the decision.
Material red flags
Risk drivers and the evidence behind them.
Prioritized questions
The questions still open, and the evidence we would need to close them.
Executive summary
Findings translated into implications for the transaction or commitment.
Your engagement team
Meet the specialists
A principal leads each engagement. Your proposal names the specialists assigned to the scope.
Piotr Cielas
Principal Advisor
Head of Security at Agora, responsible for security, data protection, and corporate IT risk. Earlier at EY, led assessments across financial services, healthcare, and government.
Timur Güvenkaya
Founder & Partner
Led a security engineering practice for Rust and non-EVM systems across Substrate and NEAR. Earlier, built vulnerability-detection engines at Invicti used by Fortune 50 and public-sector organizations.
Paul Vijender
Specialist Advisor
Head of Security at Gauntlet, with experience in product security, IAM, cloud, DevSecOps, and blockchain. Previously held security roles at Tensor, EY, Broadcom, and ADP.
FAQ
Frequently asked questions
How much access do you need to the target?
We scope the work around the available documentation, interviews, and operational evidence. If the review includes code, we need access to it during scoping. Without code, some implementation claims may remain unverified. The report distinguishes supported conclusions from open questions.
Can you assess a vendor as well as an acquisition target?
Yes. Diligence can support vendor selection, investment, acquisition, partnership, or grant decisions. We tailor the review to the technical risks and dependencies you would take on.
Can you work inside a deal timeline?
We scope the work around your decision date and available access. If the timeline limits what can be examined, the report identifies those gaps and their implications.
Do you give a go or no-go recommendation?
We explain the technical risks, remediation effort, and unresolved questions relevant to the decision. The investment, acquisition, or vendor decision remains with you.
Can you use previous audits or assessments?
Yes. We assess their scope, findings, remediation evidence, and relevance to the current system. Previous reports help focus the work, but they do not establish the security of changes made since the review.
Related services
Other ways we can help
Risk Assessment
Give leadership a prioritized view of where security risk concentrates and what to address first.
Explore 
Secure Code Reviews
Find security flaws in critical code, including authorization, business logic, and state changes.
Explore 
Digital Asset Program Advisory
Make security, custody, vendor, and operating-model decisions across a broader digital asset program.
ExploreDiscuss your due diligence questions.
Describe the decision, available access, and deadline. We will propose a diligence scope.
Discuss your scope