Protecting organizations that refuse to compromise on cybersecurity
Drawing on experience from enterprise environments and highly-regulated industries such as banking, healthcare, national defence, and aerospace, our senior cybersecurity consultants turn findings into refinements your team can implement immediately.
All certifications conferred upon AMR CyberSecurity Limited remain valid under its current legal entity. The SOC 2 attestation applies to Infinum only.
Why security-focused teams choose us
1
Independently verified expertise
We hold NCSC CHECK, CREST, and STAR accreditations. We’re also a Cyber Essentials and Cyber Essentials Plus certification body, a PCI Qualified Security Assessor company certified to ISO27001 and ISO9001, and we maintain a SOC 2 attestation. This ensures our methods, reporting, and internal processes meet strict, internationally recognised security standards.
2
Experts who think like attackers
All testing is carried out by highly vetted consultants with extensive backgrounds in offensive security and secure software development. Our team holds recognised certifications, including CISSP, CHECK CTL, CHECK CTM, CREST, OSCP, CSTL, and CSTM, and has delivered CSAS-approved red-team engagements.
3
Clear reporting, immediate implementation
Our approach focuses on what attackers actually exploit, not theoretical checklists. You get a well-structured process from scoping to reporting, with reliable timelines and no surprises. Every finding includes clear remediation guidance and a plain-language explanation of business impact.
Cybersecurity services that strengthen your systems end-to-end
Penetration testing
Our certified experts mimic real attackers to uncover vulnerabilities across your systems and provide clear, actionable guidance to help you remediate them.
Certified experts
Industry-standard methodology
Practical remediation steps
Manual, tailored assessment
Clear, prioritised set of findings
Expert support through mitigation
- Web pentest
- Mobile pentest
- API pentest
- External infrastructure pentest
- Internal infrastructure pentest
- Cloud environment pentest
- Wireless (Wi-Fi) pentest
- Container/Kubernetes security assessment
- Database pentest
Red teaming
Exposing vulnerabilities in your organisation’s people, processes, and technology, providing intelligence-driven remediation strategies.
We develop tailored attack scenarios based on the risks your organisation is most likely to face, assess relevant threat actors and their access levels, and turn complex technical activity into a clear, prioritised report with practical guidance to help you reduce vulnerabilities.
- Asset and threat identification
- Custom attack scenario development
- Comprehensive reporting
- Alternative solution development
- Actionable remediation guidance
- Post-engagement support
Secure Software Development Life Cycle (SSDLC)
Build secure software from the ground up or strengthen the security of systems already in production. Our team combines decades of deep development and security expertise to integrate security across every stage of your software lifecycle.
PRE-PRODUCTION
1
Requirements and planning
Threat modeling, secure requirements, secure architecture
2
Design and development
SCA, SAST, container scanning
3
Secure code review and testing
DAST, vulnerability scanning, penetration testing
PRODUCTION
4
Release and deployment support
Secrets management, secure transfer, and access management of package repositories
5
Maintenance and monitoring
Monitoring, incident response, patching
Secure architecture
Our experts assess existing and planned architecture, identify weaknesses, define security controls and patterns, and ensure that IT, cloud, and OT systems are designed and implemented securely.
Whether you need a single component reviewed or a full end-to-end architecture defined, we ensure security is built in from the first diagram through day-to-day operations, keeping your critical information and operations protected.
- Security architecture design
- Security architecture assessment
- Security architecture implementation
- Compliance and best practice alignment (standards such as ISO 27001, NIST CSF, PCI DSS, CIS Controls)
Governance, risk, and compliance (GRC) services
From core GRC support to specialised accreditation consultancy, our team helps you build a mature, resilient security framework that protects your organisation and meets the demands of modern regulation.
We embed security into everyday operations and give you the confidence that your governance, risk, and compliance obligations are fully covered. Whether you need hands-on policy work, certification support, regulatory compliance, or incident readiness, our experts bring clarity, structure, and practical guidance that lasts.
GOVERNANCE & RISK MANAGEMENT
- Core GRC services
- ISO 27001 compliance and certification support
- GDPR compliance and DPO-as-a-Service
REGULATORY, INDUSTRY, AND UK GOVERNMENT COMPLIANCE
- NIS2 compliance
- PCI DSS compliance
- SWIFT CSP consultancy
- UK Government & CNI accreditation
RESPONSE & RESILIENCE
- Incident response
- Post-incident review and recovery support
PCI DSS compliance
Partner with a leading PCI QSA company in the UK and Europe and get expert, end-to-end guidance through the full assessment process.
We simplify the complexity, validate your security controls, and help you achieve compliance quickly and cost-effectively. If you need architecture guidance, documentation support, or full Level 1 assessments, our team will provide the clarity, expertise, and hands-on help to protect cardholder data and meet PCI requirements with confidence.
- Pre-assessment support
- SAQ & AoC assessment
- RoC & AoC assessment
- Security architecture
Operational technology (OT) security
We provide dedicated security assurance and testing services for organisations running OT environments, including ICS and SCADA systems, as well as those designing or supporting OT products.
Our specialists help you secure mixed IT–OT systems, validate controls, meet industry frameworks, and maintain long term operational resilience.
- Risk assessment
- OT product and component design assurance and security testing
- System design assurance for IT and OT environments
- Security testing of IT and OT implementations, including validation of control effectiveness
- Compliance audits against ISA/IEC 62443 and NIST frameworks
- Support for ongoing compliance with ISA/IEC 62443 and NIST frameworks
- Bespoke training
MEET THE TEAM LEADING YOUR SECURITY PROGRAMME
Martin Walsham
DIRECTOR OF CYBERSECURITY, UK
A recognized cybersecurity leader with deep expertise in risk management, security architecture, policy development, accreditation, and security leadership. He has built strong relationships across industry, government, and regulators, and has helped shape security standards through research and his role on the UK CREST Executive Board.
Rachel Bi
SALES DIRECTOR, UK
Rachel is an experienced cybersecurity account director with a strong track record in delivering penetration testing, GRC, security architecture, and incident response services. With 15 years supporting UK and international clients across finance, government, telco, health, tech, and critical national infrastructure, she is a trusted partner to organisations seeking reliable assurance and high-quality service delivery.
Neven Matas
CYBERSECURITY TEAM DIRECTOR, EU
Neven is the Cybersecurity Team Director at Infinum, where he has spent 10 years building high-performing teams and establishing new security-focused services. He focuses on ensuring digital products are resilient against modern threats and aligned with best practices in secure software development.
Make security proactive, not reactive
Don’t risk getting compromised.
The information above will be stored only for
business purposes. Check our Privacy Policy for
more info.
READ ABOUT CYBERSECURITY
Social engineering
Expose human vulnerabilities and build your team’s resilience through real-world testing and structured security awareness training.
Minimize the chances of confidential information leaks due to human error. Using social engineering services, organizations can evaluate and educate their employees on how to identify potential cybersecurity threats.