# Ongyo — independent security consultancy

Web version: https://ongyo.net/

Ongyo is an independent security consultancy for B2B organisations. It helps business and technology leaders make clear security decisions, strengthen compliance and secure cloud and SaaS platforms, including platforms using AI.

## Security leadership and compliance

Focused assessments, fractional CISO leadership and ongoing advice. Work can cover security strategy, roadmaps, risk management, control ownership, policies and board reporting; end-to-end ISO 27001 and SOC 2 programme leadership; AI governance and third-party assurance; incident planning and business resilience.

Ongyo leads and supports programmes from initial scoping through gap assessment, control implementation, evidence collection, remediation and external audit coordination, with ongoing programme support. Independent bodies and auditors perform certification and attestation.

## Cloud and SaaS platform security

Review the architecture, cloud environment and delivery process before accelerating development. Work can cover AWS, GCP and Kubernetes; identity, secrets, tenant isolation and API security; code review, software supply chains and DevSecOps.

Ongyo also helps implement AI securely in products and SaaS platforms, covering architecture, data handling, permissions, integrations and operational controls. AI-enabled platform reviews assess data handling, permissions, external services, prompt injection and excessive agent access where relevant. AI-assisted and human-written code are reviewed against the same security requirements.

The outcome of a review is a prioritised view of risks, recommended controls and a remediation plan.

## Secure AI-assisted SaaS development

Ongyo can develop or improve SaaS platforms when development fits the agreed business and security priorities. Scope can include MVP delivery, applications, APIs, identity, payments, digital-content access, secure online sales, cloud delivery and operational handover.

## Working approach

1. Understand and prioritise: business objectives, existing controls, customer requirements, platform risks and agreed scope.
2. Secure and prepare: governance, cloud architecture, application controls, AI risks, assurance evidence and remediation.
3. Build and improve: secure development and cloud delivery when needed.

Each phase can be a focused engagement; consultancy does not require commissioning a build.

## Clients and contact

Business and technology leaders, SaaS and cloud teams, and regulated organisations. Ongyo combines direct senior involvement with more than 20 years in information security. Based in EU, working internationally.

Book a [30-minute initial conversation with the Ongyo CEO](https://calendly.com/goran-pizent-ongyo/30min) or email [info@ongyo.net](mailto:info@ongyo.net).