Scope and authorisation
We agree what's in scope, how we'll test and when, and get it authorised in writing before anything starts.
No surprises for your team, your hosting provider or your customers.Cybersecurity · Nairobi, Kenya
Find the gaps before attackers do.
Our in-house security engineers test your web apps, APIs, cloud and payment flows the way real attackers would, then help you fix what matters first. For businesses across Kenya and East Africa.
What we do
Not sure what an attacker would find? Our security engineers test your apps, APIs, cloud and payment flows the way attackers do, then help you fix what matters first.
- Penetration testingWeb apps, APIs and mobile apps, tested the way attackers work
- Vulnerability assessmentsFind known weaknesses across your systems, ranked by real risk
- Secure code reviewSecurity flaws found in your code before they ship
- Payment securityM-Pesa, Paystack and card flows checked for fraud, tampering and leaks
- Cloud securityAWS, Azure and GCP configuration reviews and hardening
- AI and LLM securityPrompt injection, data leaks and agent permissions, tested against the OWASP LLM Top 10
- Data protection complianceTechnical controls and evidence for Kenya's Data Protection Act and its East African peers
- Incident responseHelp containing, investigating and recovering when something goes wrong
- Ongoing security partnerRegular testing, advice and a named security lead on retainer
Who it's for.
Fintechs and payment platforms
M-Pesa, card and wallet flows checked for fraud, tampering, duplicate charges and leaked data.
SaaS and product teams
Testing before launch, and the report enterprise customers and partners ask for before they sign.
Anyone handling personal data
The technical controls and evidence Kenya's Data Protection Act and its East African peers expect.
Teams shipping AI
Chatbots and agents tested for prompt injection, data leaks and doing more than they should.
Teams after an incident
Help containing it, finding how they got in, and closing the door behind them.
Growing businesses
A named security lead on retainer, with regular testing and advice as you grow.
Test
Our security engineers test by hand, the way a real attacker would, with automated tools for coverage.
Anything critical is reported to you the same day, not saved for the report.Report
Every finding ranked by severity, with the evidence, what it means for your business and how to fix it.
Written for your engineers and your leadership, with a walkthrough call.Fix and retest
Your team fixes the issues, or ours does, since we build software too. Then we retest and confirm in writing.
Most security firms stop at the report. We can take it all the way.One team that builds and secures.
We can fix what we find.
Security engineers and software engineers on the same team, so a finding becomes a fix, not just a line in a report.
Local context.
M-Pesa, mobile money, Kenyan banks and regional regulation are what we work with every day, not edge cases.
Reports people can act on.
Clear for engineers, clear for leadership, and ranked by what to fix first.
Standards we work to
Our testing and reports align with the standards and rules your customers, partners and regulators expect.
- OWASP Top 10The most critical web application risks
- OWASP API Security Top 10How APIs are attacked, and defended
- OWASP MASVSThe mobile app security standard
- OWASP Top 10 for LLM ApplicationsSecurity for AI chatbots and agents
- PCI DSSReadiness for the card payment security standard
- Kenya Data Protection Act, 2019Technical controls for personal data in Kenya
- Central Bank of Kenya guidanceCybersecurity expectations for banks and payment service providers
- Uganda, Tanzania and RwandaTheir data protection laws, for regional businesses
Security questions.
Yes. Lineard is a software, AI and cybersecurity agency in Nairobi, Kenya. Our in-house security engineers do penetration testing, vulnerability assessments, secure code review, cloud, payment and AI security, and data protection compliance work for businesses across Kenya and East Africa.
A penetration test is an authorised, simulated attack on your systems to find the weaknesses a real attacker would use. You likely need one if you handle payments or personal data, before a major launch, after big changes, or when a partner, regulator or enterprise customer asks for evidence of security testing.
A focused test of a single web app or API typically takes one to two weeks, including the report. Larger scopes take longer. You get a fixed scope and timeline in writing before testing starts.
A report with every finding ranked by severity, the evidence for it, what it means for your business and how to fix it, plus a walkthrough with your team. Because we also build software, we can fix the issues for you, then retest and confirm the fixes in writing.
Yes, on the technical side: mapping where personal data lives, access controls, encryption, logging, breach response and the evidence you need for data protection impact assessments. We work alongside your lawyer or data protection officer, since we're engineers, not a law firm.
Yes. We test AI features for prompt injection, data leaks, unsafe outputs and agents that can do more than they should, using the OWASP Top 10 for LLM Applications. We also build AI agents, so we know where they tend to break.
No. We test any system you own or are authorised to have tested, whoever built it. We always agree the scope and rules of engagement in writing before any testing starts.
Yes. We're based in Nairobi and work with businesses across East Africa, including Uganda, Tanzania and Rwanda. Most testing can be done remotely.
Read more from our security work.
The OWASP LLM Top 10 (2026), as Code: A Node.js Fix for Every Risk
All ten 2026 OWASP LLM risks, each with a vulnerable pattern and a Node.js fix.
Letting an AI Agent Touch Money: Safe Payment Tools with Paystack and M-Pesa
Narrow tools, spending limits, human confirmation, and webhook-verified truth for agent payments.
AI, Explained for Builders: Tokens, Embeddings, RAG, Agents, and the Terms That Matter
The AI terms builders actually need — tokens to RAG to agents — with cost maths and code.
Tell us what has to work.
In a free 20-minute call, we'll talk through what you need and give you a clear timeline and estimate.
Book your free call →No commitment · We reply within 4 hours on business days