Systems

Shellhex describes itself as a holistic security company with a technical core, and our Systems offerings are that core made explicit. Most security consultancies can tell you what is wrong; far fewer can build the thing that puts it right. Our Systems work is where we do the building - the engineering, data, and operational capability behind the testing - drawing on the same deep technical grounding that makes our security work what it is. The people who understand how systems are broken are unusually well placed to build ones that hold.

Built By People Who Break Things

Most systems are built by people who have never had to attack one, and it shows - in the flat networks, the over-trusted integrations, the credentials left where anything can reach them, all of which are perfectly reasonable engineering choices right up until someone hostile is looking at them. We come at building from the opposite direction. Our engineering is informed by the same offensive work as the rest of what we do, so we build with the failure modes already in view: we know how the thing gets broken because breaking things is our trade, and that knowledge is hardest to fake and most valuable exactly at the design stage, when it costs nothing to get right. This is what "a technical core" is meant to convey - not that we can write software and configure Linux, which many can, but that we do it with an attacker's eye on the result. The systems we build are ones we would find harder to break.

Our Systems work divides into three families:

What is your data actually telling you, and how do you act on it?

Turning data into operational capability - statistical modelling of complex data, visualisations that make a finding legible, and live dashboards that put the right picture in front of the right people.

Who builds the systems your IT team or MSP finds daunting?

The design and construction of software and infrastructure - bespoke software, Linux-based systems, and resilient deployments for constrained environments - built to be maintainable by the teams who inherit them.

What happens when security fails?

The defensive and responsive side of our work - hardening systems before an attack, and investigating and recovering after one.

How We Engage

Our Systems work is delivered on a one-time, project basis in collaboration with your existing IT team or managed service provider, not as a substitute for them. We are not an MSP, a helpdesk, or a security operations centre, and we do not offer ongoing maintenance or round-the-clock support. What we offer instead is the difficult, one-off engineering those teams are not always equipped for - and we build it to be handed back to them cleanly, with an emphasis on maintainability and architectural soundness rather than ad hoc fixes that return as future problems. All Systems work is oriented around a base rate of £1,000 per day, exclusive of VAT and expenses; because these engagements vary so widely, we cannot quote fixed prices up front.

Engineering

Software and infrastructure are not neutral substrates; they are where security is won or lost long before anyone runs a test. Our Engineering offerings are where we build and rebuild the systems organisations depend on - and because we are a security company first, we build them with the failure modes already in mind. We take on the work an internal IT team or managed service provider finds daunting: the genuinely difficult system, the unusual deployment, the bespoke tool that no off-the-shelf product quite provides.

Our Engineering work spans three offerings:

Are the right tools actually in your toolbox?

Custom software built to a standard well beyond websites and databases - drawing on specialist competence in scientific computation, low-level and embedded systems, advanced interfaces, and security-first design.

Who looks after the Linux you may not know you depend on?

Designing, building, and rationalising Linux and open-source infrastructure - including the "shadow Linux" quietly running mission-critical functions across cloud, network, storage, and embedded systems.

What happens when the grid, the bandwidth, or the engineer is not there?

Systems designed for constrained environments - remote, rural, off-grid, mobile, or industrial - where reliability comes from architecture rather than from abundant power, connectivity, or support.

What Shellhex Is Not

Shellhex is not a managed service provider (MSP) and does not offer ongoing maintenance of IT systems for end clients. We do not offer any kind of helpdesk services or 24/7 support. We also do not act as a security operations centre (SOC), nor are we a security information and event management (SIEM) systems vendor.

How We Work

Rather, our systems engineering offerings are all based around collaboration with MSPs or internal IT teams on a one-time service model. Our goal is to assist MSPs and IT teams with particularly difficult systems that may prove daunting for them. These include complex Linux-based systems (especially those bridging desktop, cloud, on-premises networks, and embedded systems), rural and off-grid systems (where energy, bandwidth, and hardware maintenance may be constrained), or those where developing bespoke software applications is needed.

Our goal is to set up these systems in ways that existing MSPs and IT teams can then maintain. We place emphasis on maintainability and architectural cleanliness; we aim to fix potential long-term issues at the root, rather than provide ad hoc patches that will need further maintenance down the road. We hope you'll never need to ask us to improve your systems twice.

Security-First Engineering

Shellhex is a security company, and our engineering offerings have this in mind. An important aspect of our systems engineering offerings is hardening the stack your digital infrastructure is built on. While we cannot claim any system is perfectly secure, we do utilise our knowledge of offensive security, as well as our familiarity with numerous forms of security tooling, to guide how we develop, configure, and deploy systems.

Systems Experience

Our team has years of experience with managing servers and network applications in domains as diverse as high-performance computing, big data, web startups, and end-to-end encrypted communication.

Security Operations

Every security company - Shellhex included - aims to protect its customers from attack. Defensive security aims to build systems and processes that can prevent attacks; offensive security - Shellhex's focus - aims to test and thus improve defensive security systems by systematically probing their weakest points. But what happens when security fails? The reality is that there is no such thing as perfect security; cyberattacks are an aspect of the modern world, and all organisations should contend with the possibility that they could be breached.

If an attacker got access to your systems, what would happen next? That depends on you. Our Breach Impact security testing service, and our Tabletop Exercise leadership service, aim to assess how your organisation would respond to an attack. Our Security Operations offerings aim to directly assist your organisation in actually responding to attacks - and setting up your organisation's systems and processes so that their damage is minimised from the outset.

Our Security Operations work falls on either side of an incident. Before an attack, we help you build systems whose damage is contained from the outset:

Can you actually build the defences your assessments recommend?

Turning security findings and designs into working, hardened systems - the implementation arm that closes the gaps testing reveals.

If an attacker gets in, can they reach everything that matters?

Designing how data is stored, segmented, and protected, so that a single foothold does not become a total loss.

After an attack, we help you understand and recover from what has happened:

What actually happened?

Establishing how an attacker got in, what they reached, what they did, and whether they are still present.

How do you regain control?

Containing an active incident, eradicating the threat, and restoring safe operation under the uncertainty a real breach creates.

What Security Operations Is Not

Shellhex is not a security operations centre (SOC), nor do we act as a vendor of security information and event management (SIEM) systems. We can't claim to offer 24/7 monitoring of your systems, nor do we claim to be on-call at a moment's notice if an attack occurs. Real-time response to attacks is critical to security, but facilitating it is something we delegate to other companies in complementary roles. We don't aim to compete with existing blue-team cybersecurity companies and security monitoring solutions.

Rather, what we offer is at an additional step of indirection. Before an attack, we can consult to help your IT team or managed service provider preemptively take action to limit the damage future attacks can cause. Once an attack has happened, we can help your organisation respond to the incident so as to minimise the real harm your organisation suffers, and help you understand what the attackers actually did.