Security consultancy · founder-led
Security built in layers, around the way you already work.
For companies that need to pass an audit, clear an enterprise security review, harden their cloud or detect threats, without building a full in-house team. Working with clients in the US, East Africa and beyond.
What we do
Three layers, one system.
Governance defines the controls. Engineering builds them into the systems you run. Operations shows they hold. Engage one layer on its own, or all three.
A crack that gets past one layer meets the next, and turns aside. What operations learns flows back into the controls.
Governance, risk and compliance
Risk assessments, policies and compliance programmes for the frameworks your customers and regulators ask for, such as SOC 2, ISO 27001 or NIST CSF. The evidence comes from the controls themselves, so audit season stops being a spreadsheet hunt.
YOU HOLDRisk register, policies your team can follow, a control map per framework, evidence from live systems
Security engineering
Cloud security, identity and access, logging and telemetry, infrastructure-as-code guardrails and security automation. Built into the systems you already run, with your tools or ones we recommend.
YOU HOLDA baseline report per account, guardrails merged as code, a logging coverage map, runbooks for your engineers
Security operations
Detection engineering, response playbooks and agentic SecOps. AI agents gather context and write the summary; a person approves every containment action. We build it and hand it over, run it with your team, or operate alongside you in stated hours.
YOU HOLDDetections with test cases, response playbooks, investigation records, a monthly evidence pack
AI security and governance. Guardrails and evaluation for the models and agents you build, so they act within the limits you set. A growing part of our work.
A crack cannot run straight through nacre. Each soft layer turns it aside until it stops.
Nacrion, said NAY-kree-on, is named after nacre, the material that lines a shell. We build security programmes on the same principle. No single layer has to be perfect, because the structure holds.
We layer around your shape.
Nacre does not choose the shape of its shell. It forms against whatever surface it lines, and it is strongest where it fits most closely.
We start from your organisation, your systems and the tools you already run, then add layers where they are needed. Scope, pace and the frameworks you answer to all follow you. Some things never move.
OPERATE
Audit readiness programme
Ready for a SOC 2 or ISO 27001 audit, with evidence drawn from controls that run every day.
- LAYERS
- Define + Build
- TYPICAL
- 8 to 12 weeks
- TOOLS
- Yours, or ones we recommend
Adjustable. We shape scope and pace with you on the call.
Book a scoping call →- The deliverables, listed by name
- The outcome we are working toward
- The evidence you hold at the end
- The cost, agreed in writing
- Scope, pace and the order of work
- The frameworks you answer to
- Your tools, or ones we recommend
- How closely your team is involved
We design and build alongside your engineers.
- WE DO
- Architecture, pairing, code review
- YOUR TEAM
- Builds with us and owns the result
Starting points
Every engagement begins from one of these and is shaped in a scoping call. Names, scope and timelines are typical and all of them adjust.
Cloud and identity baseline
Your cloud accounts and identity provider meet a written baseline, with drift alerts in place.
Account structure, IAM and SSO review, logging, guardrails as code.
4 to 6 weeks
typical · adjustable
Audit readiness programme
Ready for a SOC 2 or ISO 27001 audit, with evidence drawn from controls that run every day.
Gap assessment, policies, control mapping, evidence collection, auditor liaison.
8 to 12 weeks
typical · adjustable
Detection and response build
Detections for your highest risks, written playbooks and agent-assisted triage your team can run.
Telemetry review, detection engineering, playbooks, handover or shared running.
6 to 10 weeks
typical · adjustable
Layered partnership
A standing programme across all three layers, paced to your roadmap.
Quarterly plan, monthly evidence pack, a named engineer.
Rolling
reviewed quarterly
What we hold ourselves to, and how you can check.
Layered
No control is trusted alone.
YOU CAN CHECKYour control map names the second control behind every critical one.
Calm
Measured language and plain reporting.
YOU CAN CHECKReports give severity in words and numbers. Nothing depends on a red light.
Evident
Every claim we make can be proven.
YOU CAN CHECKEach deliverable ships with its configuration exports, logs, test results and sign-offs.
Resilient
Stronger after an incident, not just restored.
YOU CAN CHECKEvery incident closes with a written record of the change we made and the test behind it.
Who you work with
Founder-led. The person who scopes your work is the person who builds it.
Nacrion is led by an engineer who has worked in every layer of a security programme. That means writing the policy and mapping the controls, building the cloud and identity guardrails, then running the detections that show they hold. One person can follow a gap from the audit finding to the fix to the evidence.
- GOVERN
- Risk, policy and compliance programmes
- ENGINEER
- Cloud, identity, logging, infrastructure as code, automation
- OPERATE
- Detection, response and agent-assisted investigation
- EMERGING
- Securing AI platforms and agentic systems
- CLIENTS
- Global. In the US and East Africa today, and more regions as we grow.
We are new, so we show our work instead of logos.
Before you sign, you can read our written method, see a redacted sample deliverable and get a fixed scope and cost in writing.
Ask for the sample deliverable