an independent practice, deliberately small
devwalls was founded in 2026 by two testers who were tired of selling reports nobody read. Thirty-one people later, the thing we optimise for has not changed: the engineer receiving the report should be able to act on it that afternoon.
- founded
- 2026
- people
- 31
- offices
- Abuja, London
- ownership
- Independent, employee-held
We stayed small on purpose. Scale is how this industry stopped being good at this.
The commercial pressure in security testing runs one way: hire faster than you can train, template the report, sell the retest separately, and let a scanner do the reading. It produces documents that pass procurement and change nothing.
We grew at roughly four people a year, and every one of them shadowed engagements for a quarter before running one. That is slow, and it is the reason we can put a named principal on every engagement without it being a fiction.
The company is owned by the people who work in it. There is no investor asking why utilisation is at eighty per cent instead of ninety-five, which is the number at which testers stop finding interesting things.
the constraints are the product
We do not sell software
No platform, no licence, no dashboard you have to keep paying for. When an engagement ends you own everything we produced, and you can take it to another firm.
We do not resell tooling
We have no commercial relationship with any vendor whose product we might recommend, and we will tell you when the honest answer is that you already have what you need.
We do not take engagements we cannot staff
If the right people are not free, we say so and suggest who else is good. We have turned down roughly one in five enquiries for this reason.
We do not bill for retests
Checking whether our own recommendation worked is part of the work, not a second invoice.
abuja
Plot 1129, Wuse II
WAT / UTC+1
london
4 Ravey Street, EC2A
GMT / UTC+0
tell us what you would least like us to reach
Scoping is a conversation with the people who own the systems, not a form. Twenty minutes is usually enough to tell whether we are the right practice for the problem.