Operational Security Review
Your code is audited.
Is your operation?
An audit covers the protocol layer. The Operational Security Review covers the other two: how your system is built and deployed, and how your team runs it. Code and operations are two different threat surfaces. An audit only looks at the first one.
Why it matters
Where the big losses actually originate
Multisig misconfigurations, key management failures, governance exploits, deployment mistakes. A perfectly audited contract offers no protection if the deployer key is compromised. Our State of Web3 Security report shows human-vector attacks now exceed every code-level defect category combined.
Scope
What the review covers
Multisig design & signing
Threshold design, signer independence, signing ceremonies, out-of-band verification.
Key management
Generation, storage, rotation, and revocation of deployer, admin, and validator keys.
Access control
Who can touch what: accounts, devices, repositories, cloud consoles, and SaaS.
Governance & timelocks
Quorums, delegation, emergency powers, and whether timelocks sit on the critical path.
Deployment security
CI/CD integrity, bytecode verification, upgrade paths, and release authority.
Validator infrastructure
Node operations, monitoring, and the control planes behind your network presence.
Incident response
Runbooks, pause authority, escalation paths, and recovery ability.
The review applies TRACE for Systems and TRACE for Organisations: a structured model of your trust boundaries, privileged roles, and critical invariants, with a prioritised risk register and a 30/60/90-day hardening roadmap, not a compliance checkbox. We tailor the scope to your setup. Complex environments (validators, multi-chain, custody) are quoted individually.
Get SEAL certified on the back of it
We're an accredited firm for the Security Alliance (SEAL) operational security certification. The same review can take you through their framework, and when you pass, SEAL issues a verifiable on-chain attestation through the Ethereum Attestation Service. It covers multisig ops, treasury, incident response, infrastructure, DNS, and identity.
See the SEAL frameworkRequest a review
Tell us about your project and we will get back to you within one business day.