FOR WEB3 FOUNDERS & TECHNICAL TEAMS
Lead security, uncover operational risks, prepare for audits, and rehearse recovery—with practical support for the people and systems your business depends on.
Access & devices / Cloud & delivery / Wallets & signing
01 / OUR EXPERTISE
Security leadership, operational assessments, compliance readiness, or recovery planning and exercises. We agree on scope and deliverables before work begins.
WHEN YOU NEED SECURITY OWNERSHIP
Bring structure to security without a full-time CISO hire. Give your team a clear owner, a practical roadmap, and support for customer security reviews.
A security roadmap, a risk register, clear control owners, and a reporting cadence that keeps decisions moving.
WHEN YOU NEED A CLEAR RISK PICTURE
Understand how admin access, cloud configuration, deployments, and signing workflows could expose your business—and what to fix first.
A scoped assessment report, prioritized findings, and a remediation plan with practical next steps.
WHEN TRUST NEEDS EVIDENCE
Prepare for audits, customer security reviews, and recognized security standards. Turn requirements into practical controls your team can maintain.
SOC 2 · ISO/IEC 27001
NIST CSF · CIS Controls
A gap analysis, a prioritized control roadmap, and an evidence tracker aligned to the standards or frameworks agreed in your scope.
WHEN DOWNTIME BECOMES BUSINESS RISK
Keep critical operations moving through disruption. Turn recovery plans into realistic exercises that show what works, what fails, and what to improve.
Cloud outages · Lost admin access
Vendor failure · Backup recovery
A prioritized continuity and recovery plan, assigned recovery roles, and an exercise report with observed timings, gaps, and corrective actions.
Not sure which fits? Start with your biggest concern. We’ll clarify the scope together.
BEYOND THE SMART CONTRACT
A smart contract audit is one layer. The people who deploy code, approve transactions, and recover access are part of the security model too.
We examine how those layers work together: who can change production, who can move assets, and what happens when something goes wrong.
Who has access—and how is it protected?
What can reach production—and who can change it?
How are transactions approved and access recovered?
CONTINUITY YOU CAN PUT TO THE TEST
A plan becomes useful when your team knows how to use it under pressure.
Start with the operations you cannot afford to lose. Agree on acceptable downtime and data loss, then test the people, dependencies, and recovery steps behind them.
Know who acts, which services come back first, what the exercise demonstrated, and which gaps still need work.
EXAMPLE EXERCISES · SCOPED TO YOUR ENVIRONMENT
Rehearse a rollback or recovery to an agreed alternate environment. Validate service health, key dependencies, and the time needed to restore critical operations.
Evidence: recovery timings, validation checks, and unresolved dependencies.Walk through authorized emergency access, identity verification, and account recovery. Check that the right people can act without bypassing approval controls.
Evidence: recovery ownership, access checks, and escalation gaps.Simulate a KYC, RPC, or other essential vendor outage. Test which activities can continue, which must pause, and how your team communicates and resumes service.
Evidence: continuity decisions, fallback procedures, and communication steps.Restore selected data into an isolated environment. Verify its integrity, confirm that the application can use it, and compare recovery results with your agreed objectives.
Evidence: restore results, observed data loss, and recovery gaps.Tabletop exercises and controlled technical drills are agreed in advance. Production testing requires a separately approved scope.
FROM FINDINGS TO ACTION
An assessment should make the next decision easier. Findings connect the exposure, the potential impact, and the work needed to reduce risk.
ILLUSTRATIVE DELIVERABLE · NOT A CLIENT FINDING
02 / HOW WE WORK
A focused engagement, grounded in your architecture, business priorities, and team capacity.
Understand your architecture, critical assets, business goals, and constraints. Agree on scope before the work begins.
Separate urgent exposure from longer-term improvements. Give each priority an owner and an achievable next step.
Support implementation within the agreed scope, review evidence of change, and leave your team with a clear path forward.
03 / WHO YOU WORK WITH
Founder · CISO · Engineering background
Security decisions grounded
in how systems actually work.
Direct access to the person doing the work.
ChainFence is a founder-led practice combining security leadership and hands-on engineering. You work directly with Miloš to connect business priorities, technical risks, and the controls your team can maintain.
A FEW USEFUL ANSWERS
Web3 startups and growing teams that need experienced security leadership, an independent view of operational risk, security compliance preparation, or practical continuity and recovery support.
If your priorities are unclear, start with a scoped assessment. If you need ongoing ownership, fractional CISO support may fit. If a security review or audit is the immediate goal, start with a compliance readiness assessment. If your concern is downtime or untested recovery, start with a continuity and recovery review.
Not by default. We agree on the scenario, environment, participants, and safeguards first. Exercises can start as a tabletop or an isolated restore test; any production activity requires explicit agreement.
The Web3 Security Assessment focuses on operational security, infrastructure, access, and signing workflows. Smart contract code audits require a separately agreed scope and specialist expertise.
Examples include SOC 2, ISO/IEC 27001, NIST CSF, and CIS Controls. We agree on the relevant requirements and scope for your business, then build a practical readiness plan.
No. ChainFence supports readiness, control implementation, and evidence preparation. Independent audits and certification, where applicable, remain with your selected audit or certification provider.
YOUR NEXT STEP
You don’t need a complete brief or a chosen service. Start with the security question you need to answer.
START A CONVERSATION
Tell us about your team, your main security concern, and any upcoming milestone.
Email ChainFencecontact@chainfence.ioPrefer your own email app? Write directly to the address above.