Nincol works in the space between a business problem and a development contract, when the most consequential choices are still reversible.
Many costly software failures begin before a line of code is written: unclear scope, optimistic budgets, habitual architecture choices and vendor agreements that are hard to evaluate. Nincol works in that window.
The goal is not a larger project. It is a better decision, supported by evidence and documented well enough for your team to use.
Nincol Consultancy is a practitioner-led technology advisory practice. Engagements are carried out by people who build and operate production systems, not by account managers who pass the work on. Specialist expertise is brought into an engagement where the agreed scope requires it.
You deal directly with the people writing the recommendation, and it remains defensible whether Nincol, your internal team or another vendor does the build.
The right recommendation may be to build, buy, delay, simplify, change direction or use another implementation provider. It should remain valid even when Nincol does not perform the implementation.
Product and software strategy
Solution architecture
APIs, integration and identity
Security review and assurance
Payments and systems for this market
Cloud, platform and delivery
Technology leadership
Capability development
The independence test
That test decides what we take on, how far a scope goes and when we say no. Both halves of it are written down here so you can hold us to them.
Capability and experience
Nincol Consultancy is a practitioner-led technology advisory practice. Engagements are carried out by people who build and operate production systems, not by account managers who pass the work on. Specialist expertise is brought into an engagement where the agreed scope requires it.
You deal directly with the people writing the recommendation, and it remains defensible whether Nincol, your internal team or another vendor does the build.
Nincol Consultancy is based in Nairobi, Kenya and works with clients across the region.
Advisory work is only useful if you can act on it. Every engagement ends in a written document you own and can hand to any vendor. This is how findings are recorded.
Any visitor can reach the login form and attempt credential guessing against accounts with full data access.
Remediation. Restrict by source address at the proxy and require multi-factor authentication for staff.
Changing a numeric identifier in the request returns another customer’s order history and phone number.
Remediation. Enforce ownership checks in the query layer rather than in the interface.
Published vulnerabilities affecting this release will not receive vendor patches.
Remediation. Plan a staged upgrade to the current long-term support release.
| Ref | Severity | Finding |
|---|---|---|
| NC-01 | critical | Administrative interface reachable from the public internet Any visitor can reach the login form and attempt credential guessing against accounts with full data access. Remediation. Restrict by source address at the proxy and require multi-factor authentication for staff. |
| NC-02 | high | Customer records returned without authorisation checks Changing a numeric identifier in the request returns another customer’s order history and phone number. Remediation. Enforce ownership checks in the query layer rather than in the interface. |
| NC-03 | medium | Framework two major versions behind, outside security support Published vulnerabilities affecting this release will not receive vendor patches. Remediation. Plan a staged upgrade to the current long-term support release. |
Every finding carries a severity, the business impact behind it and a specific remediation step. No client system is shown; this extract is written for illustration.
Selected professional experience behind this advice is public. Review it, then describe the decision in front of you and receive a useful next step.
