Nincol works in the space between a business problem and a development contract, when the most consequential choices are still reversible.
Many costly software failures begin before a line of code is written: unclear scope, optimistic budgets, habitual architecture choices and vendor agreements that are hard to evaluate. Nincol works in that window.
The goal is not a larger project. It is a better decision, supported by evidence and documented well enough for your team to use.
The independence test
That test decides what we take on, how far a scope goes and when we say no. Both halves of it are written down here so you can hold us to them.
Capability and experience
Nincol Consultancy is a technology advisory practice. Engagements are delivered by practising engineers who build and integrate production systems, not by account managers who pass the work on. That is why the advice holds up when your development team starts asking hard questions about it.
You speak directly to the person writing the recommendation, and it remains defensible whether Nincol, your internal team or another vendor does the build.
Nincol Consultancy is based in Nairobi, Kenya and works with clients across the region.
Advisory work is only useful if you can act on it. Every engagement ends in a written document you own and can hand to any vendor. This is how findings are recorded.
Any visitor can reach the login form and attempt credential guessing against accounts with full data access.
Remediation. Restrict by source address at the proxy and require multi-factor authentication for staff.
Changing a numeric identifier in the request returns another customer’s order history and phone number.
Remediation. Enforce ownership checks in the query layer rather than in the interface.
Published vulnerabilities affecting this release will not receive vendor patches.
Remediation. Plan a staged upgrade to the current long-term support release.
| Ref | Severity | Finding |
|---|---|---|
| NC-01 | critical | Administrative interface reachable from the public internet Any visitor can reach the login form and attempt credential guessing against accounts with full data access. Remediation. Restrict by source address at the proxy and require multi-factor authentication for staff. |
| NC-02 | high | Customer records returned without authorisation checks Changing a numeric identifier in the request returns another customer’s order history and phone number. Remediation. Enforce ownership checks in the query layer rather than in the interface. |
| NC-03 | medium | Framework two major versions behind, outside security support Published vulnerabilities affecting this release will not receive vendor patches. Remediation. Plan a staged upgrade to the current long-term support release. |
Every finding carries a severity, the business impact behind it and a specific remediation step. No client system is shown; this extract is written for illustration.
