What we do
Penetration testing. Web applications, APIs, external and internal networks, cloud tenancies and people, tested by hand. Every engagement is quoted at a fixed price before it starts, and a retest of every finding is included, with a letter of attestation you can hand to clients, auditors or insurers.
SIFT email fraud protection. An inbound email screen that judges what a message is asking for, not just what it contains. It holds fake invoices, changed bank details and impersonated suppliers or bosses, and explains every hold in plain English. It works with Microsoft 365, Google Workspace and any standard mailbox.
Cybersecurity partner. A security team on retainer for organisations without a full-time CISO: a risk assessment, a short prioritised roadmap mapped to CIS and NIST, hands-on help putting the fixes in place, and an adviser you can call afterwards.
How we work
- Sized to the business. A 20-person firm with one web application does not need, and should not pay for, an enterprise engagement.
- Written to be fixed. We measure a report by how many findings are closed within 90 days, so each one comes with reproduction steps and remediation a developer can act on.
- Aligned to the standards you answer to. NIST, CIS, OWASP, ISO 27001 and POPIA. Testing follows the OWASP testing guide, PTES and NIST SP 800-115.
- No surprises at the end. We tell you the moment we find anything critical, not in the final report.
Research we publish
In 2026 we checked the SPF, DKIM and DMARC records of 58,769 verified South African business domains. The South African Email Security Census found that 84.3% of them can be spoofed. The same checks are free to run on your own domain: the email spoofing check and the look-alike domain check. We also write about what POPIA's "reasonable security measures" means in practice.
Where we work
CyberFrame is headquartered in South Africa and works remote-first. External, web, API and cloud testing is delivered to clients anywhere; internal network testing is done on site in South Africa or over a jump host elsewhere. Questions are answered in English or Afrikaans.
