Cybersecurity & consulting

Know your attack surface. Then close it.

Cybersecurity firm serving Kenya, East Africa, and Africa. Tradescene Tech delivers penetration testing, red team operations, SOC-as-a-service, zero-trust architecture, cloud security, ISO 27001 and SOC 2 readiness, and incident response for businesses in Nairobi, Muranga, and across the continent.

We assess, harden, monitor, and respond. Offensive testing meets defensive operations meets the strategy layer that ties them together — one team, one engagement, one report you can actually act on.

Book a threat briefing See our methodology
Offensive & defensive in one team Evidence-grade reporting No lock-in
threat-console · tradescene · root@kali LIVE
CHANNEL SECURE RULES 1,284 EVENTS/MIN —
// threat feed
Capabilities

Full-spectrum security coverage.

Six capabilities, one engagement. We combine them based on where your risk actually sits — not on what's easiest to sell.

01

Offensive security

External & internal penetration testing, red team, social engineering, and continuous automated offensive scanning.

  • Black / grey / white box testing
  • Web, mobile, API, network, cloud
  • Red-team campaigns & scenario drills
02

Defensive operations

SOC-as-a-service, managed detection & response, endpoint telemetry, and alert triage staffed by humans who can read context.

  • 24/7 MDR with named analysts
  • EDR / XDR deployment & tuning
  • Runbooks, escalation, containment
03

Identity & access

Zero-trust architecture, SSO rollout, privileged access management, and the identity hygiene most breaches actually stem from.

  • Zero-trust design & rollout
  • SSO, MFA, conditional access
  • PAM & secret rotation
04

Cloud security posture

Configuration audits, IaC review, workload identity, and continuous posture monitoring across AWS, Azure, and GCP.

  • CSPM rollout & tuning
  • Container & Kubernetes hardening
  • IaC & pipeline security review
05

Compliance & risk

Readiness for ISO 27001, SOC 2, GDPR, the Kenya Data Protection Act 2019, and PCI DSS. Evidence trails built as a byproduct — not as a fire drill.

  • Gap assessment & roadmap
  • Control implementation
  • Audit-ready evidence pipelines
06

Security awareness

Phishing simulations, targeted training, and executive tabletop exercises — the layer that stops the click before it becomes an incident.

  • Phishing & smishing simulation
  • Role-based training
  • Executive tabletop exercises

Related services from Tradescene Tech: custom software engineering, product development and maintenance, and digital transformation consulting for businesses across Kenya and Africa.

Attack path

Where attackers go — and where we stop them.

Every intrusion follows a path. Our engagement model maps that path for your specific environment, then places controls where they actually interrupt it.

01
Initial access Perimeter

Phishing, exposed services, credential stuffing, supply chain.

Phishing simulation Exposure mgmt MFA everywhere
02
Foothold Endpoint

Malware, lateral tooling, persistence mechanisms on a host.

EDR / XDR App allowlisting Host hardening
03
Lateral movement Identity

Credential theft, privilege escalation, pivoting through the network.

Zero-trust PAM Network segmentation
04
Impact Data

Exfiltration, ransomware, sabotage, regulatory exposure.

DLP Backup integrity IR retainer
Engagement models

Three ways to work with us.

From a fixed-scope assessment to a fractional security team, we scale the engagement to where you actually are.

Assessment Fixed scope

A point-in-time engagement. We map your attack surface, test it, and hand you a prioritized remediation plan.

  • 2 – 4 weeks
  • Pen test + posture review
  • Executive summary + technical report
  • Remediation roadmap
  • One re-test included
Request scope
Most chosen
Retainer Monthly

Ongoing security leadership without a full-time hire. We act as your CISO team: strategy, oversight, incident response, and continuous testing.

  • Named lead + analyst bench
  • Continuous offensive testing
  • Monitoring & triage oversight
  • Quarterly board-ready reporting
  • IR retainer & on-call escalation
Start a retainer
Embedded Fractional team

Our engineers embed alongside yours. We ship controls, tooling, and culture into your team — then step back once it holds.

  • Dedicated engineers on your stack
  • Shared sprint cadence
  • Tooling & pipeline ownership
  • Knowledge transfer built in
  • Exit criteria agreed up front
Discuss embedding
Methodology

Five phases. No hand-waving.

  1. 01

    Recon

    External footprint, OSINT, asset inventory, exposed services, and the things you forgot you were running.

  2. 02

    Assess

    Structured testing against real attacker paths. Findings ranked by exploitability and business impact — not CVE count.

  3. 03

    Harden

    We fix what we found — with your team or ours. Controls deployed, configs corrected, identities tightened.

  4. 04

    Monitor

    Telemetry, alerting, and triage calibrated to your environment. Noise reduction is a first-class deliverable.

  5. 05

    Respond

    IR playbooks, on-call rotation, and post-incident reviews that feed back into recon. The loop closes.

Frameworks & standards we work to

Built on recognized standards.

We build compliance programs against the frameworks your regulators, auditors, and enterprise customers actually ask about — including the Kenya Data Protection Act 2019.

ISO 27001Framework we implement
SOC 2 Type IIFramework we implement
PCI DSSFramework we implement
GDPRFramework we implement
Kenya DPA 2019Framework we implement
OWASPMethodology we follow
Threat briefing

Request a threat briefing.

A 45-minute session with a senior engineer. We'll walk through your current exposure, the paths an attacker would actually take, and what a fixed-scope assessment would cover. No slide deck, no sales script.

hello@tradescene.org Book a call

NDA on request. We'll sign before the first call. Learn about the team behind this work.