The quieter side of the studio.
Alongside the build work, addedPIXELS takes on security and forensics consultancy. We don't advertise it much. People have started asking anyway, so this page sets out what it covers and how it works.
It's led by our Managing Director, who holds a degree in Computer Forensics and Security, and has spent the years since securing the venues, payment networks and systems we build and look after.
We've been the ones holding the keys.
Most of our client work already sits close to the risky bits: card terminals on a bar, public Wi-Fi in a function room, member data in a back office, the on-call number at 3am. Security isn't a bolt-on for us. It's how the rest of the work stays standing.
That means we review your systems the way someone who has to run them would. We look at the network diagram and also the cupboard it lives in. Our findings come with fixes, prioritised by what's actually likely to hurt you.
We do this discreetly. We don't publish client names, case studies or findings from security work.
From the card terminal to the audit file.
Typical engagements, roughly in the order people ask about them. Most jobs are a mix of several.
Venue digital security
Clubs, bars, venues and hospitality. Public and staff Wi-Fi, CCTV and access systems, tills, AV and lighting control networks, and how they're kept apart.
Payment system networks
Segmentation and hardening around card terminals, EPOS and payment integrations, to reduce what's in scope as well as what's exposed.
PCI DSS
Gap analysis, scope reduction and remediation ahead of your SAQ or a QSA assessment. Plain-English evidence, not a binder nobody reads.
ISO 27001 & MiFID II
Technical controls, policy alignment and readiness work for ISO/IEC 27001, and the record-keeping and communications-recording side of MiFID II.
Penetration testing
Web applications, APIs, internal and external networks, and wireless. Scoped in writing, carried out under agreed rules of engagement.
Vulnerability analysis
Assessment of your estate and code against current threats, with findings ranked by real-world risk rather than raw scanner output.
Digital forensics
Evidence-preserving investigation of devices, logs and systems after something has gone wrong, with careful handling from the first image onwards.
Incident response
Containment, clean-up and the post-mortem, then the fixes so the same thing doesn't happen twice. Calm, practical, and on the phone.
Nothing is touched before it's agreed.
Security work has to be explicit about permission and scope. Every engagement follows the same shape.
-
A conversation
What you're worried about, what you're obliged to meet, and what's driving the timeline. Under NDA if you'd like.
-
Scope & authorisation
Targets, methods, windows and contacts, agreed and signed off in writing by someone entitled to authorise it.
-
The work
Testing, review or investigation, with anything critical flagged to you immediately rather than saved for the report.
-
The report
Findings, evidence and severity, plus a fix list your team (or ours) can work through in order.
-
The retest
Once fixes are in, we check they hold, and confirm what's closed and what's still open.
What we aren't.
We're not a certification body, and we're not a PCI QSA. Where you need a formal certificate or attestation, we'll prepare you for it and work alongside whoever issues it. We'll say so up front rather than let you find out at audit.
And if a job needs more people or a specialism we don't have, we'll tell you, and point you at someone who fits.
Something you'd rather not put in a contact form?
Email or call and mention security consultancy. We'll have a quiet first conversation, under NDA if you'd prefer, and work out whether it's a job for us.
Get in touch, in confidence →