Built by practitioners who got tired of the report.

L&M Cybersecurity started in 2017 with two consultants, one client and a conviction that the standard consulting model was broken. Reports were being delivered, invoices paid, and the same vulnerabilities were still there twelve months later at the next test.

What we changed

We made remediation part of the engagement rather than an upsell. Our engineers sit with your engineers, in your repositories and your consoles, until the finding is closed and the retest passes. That single decision reshaped everything about how we hire and how we price.

Where we are now

Today we are a team of 60 across offensive security, detection engineering, cloud, GRC and incident response, working with organisations across finance, healthcare, industry and government in the Middle East, Europe and North Africa. Our SOC runs continuously and our incident response hotline is answered by a responder, not a switchboard.

What we will not do

We do not sell products we also assess. We do not staff engagements with juniors under a senior name. And we will tell you when you do not need the thing you asked us to quote for — which costs us revenue and buys us clients who stay for years.