A curated selection of engagements where TrustUs delivered measurable outcomes for clients across sectors. Client names have been withheld at their request, our request, or because they are not aware they appear in this document, which is a situation we consider ethically ambiguous but legally permissible given the level of anonymisation applied.
The client's security team had not conducted a formal penetration test in three years, during which time they had acquired two new subsidiaries, migrated half their infrastructure to cloud, and replaced their CISO twice. An internal audit flagged the absence of penetration testing. The audit was then flagged as a security risk itself because it documented the absence, which created a record, which was unencrypted, which was on a shared drive. This raised morale concerns, which were addressed separately.
47 vulnerabilities identified across the infrastructure. 12 classified as critical. Remediation roadmap delivered, accepted, and acknowledged by leadership as "sobering," which is the correct response. The client is addressing findings in priority order, which accounts for the current 3 resolved. The remaining 44 are in progress. Progress is defined by the client as "active planning." Rehan defines progress differently. Both definitions coexist.
"Rehan found things our internal team had missed for three years. We are not sure whether to be grateful or deeply concerned. We have settled on both. The board has settled on alarmed, which is also appropriate."— Chief Information Officer
The client had raised Series B funding and needed a credible security programme before beginning IPO preparations. Their existing security posture consisted of one strong password policy (implemented after a breach they described as "minor," which Rehan would not characterise as minor), a general sense that security was important, and good intentions, which are not auditable against SOC 2 Type II.
SOC 2 Type II readiness achieved within the agreed four-month timeline, which Rehan considers one of his better outcomes given the starting point. Security programme implemented across all key control areas. 94% compliance score on pre-audit assessment (the remaining 6% was a vendor dependency outside their control; the vendor was aware; the auditor was informed; the auditor was understanding). The company was acquired four months later. We are choosing to see this as validation. The acquirer's due diligence team specifically mentioned the security programme. Rehan has the email. He has read it several times.
"We went from a password policy and optimism to a fully documented, auditable security programme in four months. Whether that caused the acquisition or not, we are choosing to believe it did. Rehan has been encouraged to believe it did as well."— VP Engineering
The client required continuous monitoring of a sensitive operational environment. Previous providers had been either too expensive, insufficiently discreet, unable to handle the specific threat profile, or in one case — and this is documented — a security risk themselves, which the client discovered during a routine review and which Rehan did not cause, find, or discuss further in this document.
Ongoing engagement now in its second year, which the client considers a positive sign and Rehan considers an endorsement. Over 1.2 million security events processed and triaged. Zero incidents have been publicly disclosed. The relationship between those two statistics is left as an exercise for the reader. What has occurred within the engagement beyond those figures is between TrustUs and the client, and will remain so. Rehan does not know what they do. He has stopped asking. He considers this arrangement professional and appropriate.
"TrustUs has been exactly what we needed: effective, discreet, and asking very few questions in return. Rehan has never enquired about our operations. We find this professionally reassuring and slightly unusual. Both are correct assessments."— Senior Official
Derek operates a small business and had concerns about his cybersecurity posture following an incident involving a phishing email. Derek had clicked the link. Derek had entered his credentials. Derek had then called the phone number at the bottom of the phishing email to confirm his details were received. Derek had followed up the next day via the reply address to ask if there was anything else they needed. Rehan learned of this during the initial consultation and has since referenced it, with Derek's permission, as a useful illustration of why baseline security awareness matters.
Derek has not clicked a phishing link since the engagement commenced, which he considers his greatest professional security achievement and mentions in most conversations about cybersecurity. He has referred three acquaintances to TrustUs — one converted, one is considering it, and one responded that they "have a nephew who does IT" and have not been heard from since. Derek has become TrustUs's most consistent point of contact and, via his data purchasing activity, a minor revenue contributor on both sides of the ledger. Rehan finds this relationship genuinely pleasant, which he does not say about all client relationships, but says honestly about this one.
"Rehan is the most patient cybersecurity professional I have encountered. He explained what a phishing email was four separate times across two sessions without any visible frustration, which I consider extraordinary given that I had already responded to one. Outstanding service. Outstanding patience. Outstanding."— Derek