Bickerstaffe desk · United Kingdom cohorts
An application security audit is not a slide deck. It is a cockpit: what you can see, what you cannot, and the notes you leave for the next person on watch. We teach that craft without pretending every finding is a thriller.
Open the Control Grid Studio →
The asset ledger module stopped me treating the sitemap as the inventory. I still dislike how long the write-up takes, but at least the structure no longer wobbles.
We sent two engineers. They came back arguing about residual risk in a useful way, which had never happened after our previous vendor briefing.
Flagship studio
Eight weeks of mapped walkthroughs: authentication, data flow, request tampering, and a findings memo you would actually send to a product owner. Informational fee £1,240. Enrolment is arranged by email, not a cart.
See modules and limitsHow the desk thinks
We start with a ledger of surfaces: pages, APIs, jobs, callbacks, admin corners, forgotten mobile endpoints. The application security audit then has a map instead of a mood. Learners leave with a template they can reuse on a Monday morning, not a poster of threat names.
A request that crosses three services is where the interesting mistakes live. We still sketch it by hand before we open a proxy.
Severity without a next action is decoration. We mark findings against a person who has to schedule the fix.
Numbers we actually counted
19 programmes delivered since 2019
63 learners across the last two studios
8 weeks in the flagship seat
22:00 latest UK clinic we will run
From the notes desk
Not with a scanner. With a list of things the team forgot they shipped.
A small method for product owners who were copied on the PDF by accident.
Because the first diagram is usually wrong, and that is the point.