What Firesand does

Firesand Ltd is a UK-headquartered cybersecurity services firm founded in 2016 by Matthew Holloway and Chris Blake, operating from Newport Pagnell (Milton Keynes) with a newly opened US office in Delaware. The company delivers a portfolio of professional security services built around three pillars: penetration testing and assurance (covering web applications, infrastructure, mobile, APIs, and red team engagements), security design and strategic advisory (including cloud and hybrid migrations, enterprise security architecture, and a recently launched Virtual CISO Service), and data privacy and compliance (GDPR, DPO-as-a-Service, ISO 27001, PCI DSS, and Cyber Essentials certifications). Service delivery is enabled by a heavily certified team holding more than 20 industry credentials including CISSP, CIPP/E, and an FIP designation held by one of only a handful of UK specialists.

The business operates on a primarily professional services revenue model with project-based penetration testing engagements, supplemented by recurring DPO-as-a-Service and managed IT subscriptions on monthly fixed fees, training programmes, and a white-labelled partner channel that lets security vendors, systems integrators, and consultancies resell Firesand expertise under their own brands. Go-to-market combines direct enterprise sales in regulated sectors (iGaming, Financial Services, Maritime, EdTech, PropTech) with channel partner delivery and event-driven thought leadership. The company is vendor-agnostic by design, maximizing client flexibility and positioning itself as a regulatory-compliance specialist rather than a product reseller.

Firesand has invested systematically in regulatory credentials as a competitive wedge, achieving ISO 27001 certification three times, ISO 17020 accreditation in May 2023, and active gaming registrations across 12 US states. The firm serves customers across EMEA and North America with a pronounced focus on the iGaming sector, where annual penetration testing is a regulatory requirement. The customer base disclosed in source materials skews toward SMB and mid-market clients, with named enterprise references including White Hat Gaming. The company remains privately held by its founders with no disclosed external funding or institutional investors.

Name

Firesand

Legal name

Firesand Ltd

Website

https://firesand.co.uk

Company type

Private

Founded year

2016

Operating status

Operating

Headcount range

1–10 employees

Short description

Firesand is a UK-based boutique cybersecurity services firm founded in 2016, delivering penetration testing, security architecture, GDPR/ISO compliance, and Virtual CISO services to regulated sectors including iGaming, Financial Services, and Maritime across EMEA and North America.

Ownership category

akta.pro rank

Product category

Cybersecurity Services

NAICS

Other Computer Related Services (541519), Security Systems Services (56162), Investigation and Security Services (5616)

SIC

Services-Computer Programming Services (7371)

akta.pro primary industry

Application Security Testing (SAST/DAST/IAST/SCA) (HDADACAC)

akta.pro secondary industries

Network Security Managed Services (Firewall/IDS/IPS/SASE) (BPAEADAG), Network Security Services (Firewall/VPN/ZTNA/SASE Integration) (BPAEAEAG)

Keywords

• Penetration testing services
• Cybersecurity consulting
• Data privacy compliance
• Managed IT security
• Governance risk compliance

Headquarters

HQ city

Slough

HQ country

United Kingdom

HQ region

Europe

Offices2 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations

Revenue model

1. Security Consulting and Professional Services: Deliveries of security design, development and strategy, penetration testing, digital forensics, data privacy, governance risk and compliance services. Provided as permanent, contract, or retained security services to end-user businesses and enterprises.
2. White-Labelled Partner Services: Partner program allowing security vendors, systems integrators and consultancies to white-label Firesand's expertise under their own brand. Partners can expand services to customers they previously couldn't serve.
3. Training and Education Services: Cybersecurity training including Certified Secure Software Engineer certification and general cyber courses. Also provides training for Cyber Essentials/Essentials Plus accreditation and GDPR compliance.
4. Managed IT and DPO as a Service: Ongoing managed IT services and DPO (Data Protection Officer) as a Service offering monthly fixed fees for data compliance monitoring, data loss prevention, and privacy capabilities management.

Pricing tiers

Go-to-market motion3 records

Distribution channels3 records

Marketing channels4 records

Core offering

Firesand is a specialist cybersecurity services firm delivering ethical hacking, security architecture, and data privacy services to regulated organizations. Core offerings cover penetration testing across web applications, APIs, mobile apps, and infrastructure; strategic security design and cloud/hybrid migration support; data privacy and outsourced DPO services; and governance, risk and compliance consultancy (ISO 27001, PCI DSS, Cyber Essentials).

Product overview

Firesand is a cybersecurity services company offering a comprehensive portfolio of security services rather than a unified software product. The core offerings include Penetration Testing (covering web applications, social engineering, infrastructure, mobile apps, and APIs), Security Design Development and Strategy (encompassing cloud migrations, enterprise security architecture, and strategic roadmaps), and Data Privacy services (including GDPR compliance and DPO-as-a-Service). Supporting services include Governance Risk and Compliance (ISO 27001, PCI DSS), Assurance Services (vulnerability audits, Cyber Essentials), Managed IT Services, Product Security Engineering, Digital Forensics, and Training programs. The company also offers a Virtual CISO Service for organizations needing strategic security leadership. Services can be delivered directly to end-user businesses or white-labelled through partner arrangements. The company operates primarily in EMEA and North America with a focus on regulated sectors including iGaming, Financial Services, Maritime, Prop Tech, and Educational Technology.

Differentiator

Problem solved

Functional benefit

Products and services

• Penetration Testing Ethical hacking and vulnerability assessment services that simulate cyber attacks to identify security gaps in web applications, APIs, mobile apps, and infrastructure, including blind and double-blind testing scenarios, social engineering, and credential stuffing protection.
• Security Design, Development and Strategy Translates business objectives into strategic security roadmaps covering cloud and hybrid migrations, enterprise security architecture, and security-by-design product engineering.
• Data Privacy Services GDPR compliance support, privacy training, Data Protection Officer consultancy, and ongoing privacy programme management to help organizations meet UK and EU privacy obligations.
• DPO as a Service Outsourced Data Protection Officer subscription providing ongoing monitoring, tracking, and reporting of privacy capabilities including Data Loss Prevention, automatic data retention enforcement, and DSR/SAR management for a fixed monthly fee.
• Governance, Risk and Compliance Consultancy to achieve and maintain ISO 27001 and PCI DSS compliance, including tailored structured programmes for accredited certification and ongoing governance and risk advisory.
• Assurance Services Security assurance work including vulnerability audits, penetration testing, and Cyber Essentials/Cyber Essentials Plus certification support to identify and remediate business security weaknesses.
• Managed IT Services Security-first managed IT services delivering corporate-grade secure IT infrastructure for small and medium businesses at affordable cost, including ongoing IT management.
• Product Security Engineering Security engineering service that builds security controls into products and software from design through the development lifecycle, including secure SDLC consulting.
• Digital Forensics Forensic investigation and analysis of security incidents, helping organisations respond to and investigate cyber attacks and data breaches.
• Virtual CISO Service Outsourced Chief Information Security Officer service delivering strategic security leadership, security strategy establishment, data protection, policy and architecture development, and breach response coordination.
• Cybersecurity Training Training programmes including Certified Secure Software Engineer (CSSLP) preparation and general cyber awareness courses, plus Cyber Essentials and GDPR training for organisations and project managers.

Quantifiable outcome

• Saved a client millions in potential fines following penetration test that identified a critical API vulnerability
• +1 more outcomes

Named customers3 records

Segments6 records

Ideal customer profiles4 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature3 records

Partnerships

Six partnerships are on record, tiered minor and core.

• Living Wage FoundationminorOthers · 1 May 2023Accredited by Living Wage Foundation as a UK Living Wage Business, joining 12,000 employers committed to paying the real living wage calculated according to cost of living.
• Milton Keynes and Northamptonshire Chambers of CommerceminorStrategic or Co-development Partner · 1 October 2020Member of both chambers, part of British Chambers of Commerce (BCC) Accredited Chambers network. Participate in member seminars to educate local businesses on information security and privacy issues.
• International Association of Privacy Professionals (IAPP)coreStrategic or Co-development Partner · 1 January 2020Gold Member status providing enhanced access to IAPP training and learning events. Chris Blake holds FIP designation (one of few in UK) demonstrating elite privacy expertise. Firesand engages closely with IAPP to grow knowledge and contribute expertise to privacy community discussions.
• Armed Forces CovenantminorStrategic or Co-development Partner · 1 January 2020Supporting business member of Armed Forces Covenant, an organisation ensuring serving personnel, service leavers, veterans, and their families have access to careers, education, healthcare and other opportunities. Firesand pledged support across causes including e-learning, affordable home ownership, and post-service career transition help.
• TechUKminorGTM or Marketing Partner · 1 September 2019TechUK hosted Firesand training in December 2018 on Secure by Design, enabling businesses to learn how to engineer cyber risk management into solutions from design through to delivery.
• Security Vendors, Systems Integrators and Consultancies (Partner Program)coreChannel Partner/ Reseller/ DistributorWhite-labelled partner program allowing security vendors, systems integrators and consultancies to expand their security offerings. Firesand's team of expert security advisers, consultants, architects and engineers deliver services under the partner's brand banner. All services including security design, data privacy, assurance, governance risk and compliance, and training can be white-labelled.

Scale indicators5 records

Recent moves11 records

Expansion highlights5 records

Regional players

• Lockstep Consulting / CyberCX-adjacent MSSPs: Regional MSSPs in adjacent geographies (e.g. CyberCX in ANZ) that combine managed security, GRC and consulting. Comparable to Firesand as a regional full-spectrum cybersecurity services peer, but in a different operating territory.

Broad incumbents

• NCC Group: UK-listed (FTSE) cybersecurity and resilience firm providing penetration testing, GRC and managed security services to regulated industries. Directly comparable to Firesand on core penetration testing, GRC and assurance services, but operates at much larger scale with broad geographic coverage.
• Optiv Security: Large US MSSP and security solutions integrator offering managed security, advisory and risk services. Comparable to Firesand on managed security and advisory but at vastly larger scale and with broader vendor portfolio.
• F-Secure (WithSecure): Nordic-headquartered cybersecurity firm with a large consulting/managed security arm alongside consumer products. Comparable on MSSP and security advisory services overlapping Firesand's managed IT and assurance portfolio, but operates as a multi-product incumbent.

Direct peers

• Secarma: UK-based cybersecurity services boutique offering penetration testing, security consulting and managed security. Direct peer to Firesand: comparable size, UK focus, similar penetration testing / application security testing service portfolio and regulated-sector clients.
• Bishop Fox: US-headquartered offensive security firm offering penetration testing, red teaming and application security testing. Comparable to Firesand on application/API/web penetration testing and security consulting, with greater scale and broader service portfolio.
• TrustedSec: US cybersecurity consultancy offering penetration testing, red teaming, and incident response. Comparable to Firesand on the offensive security / application security testing core, with deeper US market presence.
• Pen Test Partners: UK-based penetration testing firm specialising in web, mobile, infrastructure and cloud testing. Closest like-for-like competitor to Firesand on penetration testing methodology, CREST-style credentials and UK regulated-industry client base.

Emerging players

• Hadrian: Emerging offensive security and attack surface management player offering automated penetration testing-adjacent services. Comparable to Firesand on the penetration testing / security assessment use case but with a tech-enabled delivery model versus Firesand's pure services model.
• Immersive Labs: UK-headquartered cybersecurity training and skills platform. Adjacent peer to Firesand via the training and Cyber Essentials consultancy line, with comparable UK roots but a software/product orientation rather than services.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights6 records

Customer concentration

• Xx.com/FiresandLtd
• Facebookfacebook.com/FiresandLtd
• LinkedInlinkedin.com/company/firesand-ltd

Compliance4 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles2 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Firesand