services
Eight practices. Built, upgraded and run by the same engineers.
61 services across identity, platforms, data, cloud, AI and IoT. Every one has its own page with an architecture diagram, typical situations, the platforms involved and the questions to ask before you hire anyone.
01 / 08
Cybersecurity
Identity-first security engineering for IAM, PAM, customer identity, non-human and AI agent identity, detection, networks and compliance.
Practice overview
- Identity & Access ManagementWe consolidate workforce SSO, roll out phishing-resistant MFA and passkeys, design access policy and migrate IdPs on Okta, Entra ID and Ping.
- Identity Governance & AdministrationIGA implementation, upgrades and access certification design on SailPoint, Saviynt and Entra ID Governance, delivered by senior identity engineers.
- Privileged Access ManagementWe implement and migrate PAM on CyberArk, BeyondTrust, Delinea and Entra PIM, including vaulting, session control, just-in-time access and rotation.
- Customer Identity (CIAM)CIAM design and migration on Auth0 and Microsoft Entra External ID, including passkeys, B2B organizations, Azure AD B2C migration and CRM integration.
- Identity Threat Detection & ResponseIdentity threat detection and response: attack-surface reviews, detections for token theft and MFA abuse, and session revocation across Okta and Entra.
- Zero Trust ArchitectureWe assess CISA zero trust maturity, write identity and device-based access policy, replace the VPN with ZTNA, and plan the rollout app by app.
- Non-Human IdentitiesNon-human identity security where each service account, workload identity, secret, certificate and AI agent gets an owner and credentials that expire.
- Network SecurityNetwork security work covering firewall rule clean-up, segmentation, secure web access, vendor remote access and cloud network policy managed as code.
- Threat DetectionWe onboard SIEM logs and keep their cost down, write detections as code, map ATT&CK coverage, build SOAR playbooks and run the Sentinel portal move.
- Governance, Risk & ComplianceWe do compliance engineering for NYDFS Part 500, PCI DSS 4.0.1, HIPAA, NERC CIP and CMMC, pulling audit evidence from identity and logging systems.
- OT & ICS SecurityOT asset visibility, segmentation, secure remote access, ISA/IEC 62443 and NIST SP 800-82 assessments and OT monitoring for plants and utilities.
02 / 08
Cloud Engineering
Cloud strategy, migration, operations and DevSecOps on AWS, Azure and Google Cloud, with workload identity designed in from the first account.
Practice overview
- Cloud StrategyCloud strategy built from your application inventory, with a decision per workload, a landing zone design, an identity model and a cost baseline.
- Cloud MigrationWe migrate to the cloud with dependency maps, rehearsed cutovers and a rollback we've tested, and pull out hard-coded credentials as each workload moves.
- Cloud ManagementDay-two cloud operations on AWS, Azure and Google Cloud, covering monitoring, patching, restore tests, FinOps reporting and cloud permission reviews.
- DevSecOpsWe build DevSecOps pipelines that deploy with short-lived OIDC tokens, scan code and dependencies, sign what they build and record SLSA provenance.
03 / 08
Application Services
Web and mobile apps, API integration and legacy modernization. We work out sign-in, API authorization and data access before anyone designs a screen.
Practice overview
- Web DevelopmentWe build customer portals and web apps to WCAG 2.2 AA, measure them on Core Web Vitals, and put sign-in on Auth0, Okta or Entra ID.
- Mobile DevelopmentNative and cross-platform iOS and Android apps, kept current with App Store and Google Play rules, with OAuth sign-in and secure token storage.
- API IntegrationAPI and event-driven integrations between CRM, ERP and data platforms, secured with scoped OAuth clients, sender-constrained tokens and monitoring.
- Legacy ModernizationLegacy application modernization in slices, covering .NET and Java upgrades, mainframe workloads, business rule extraction and parallel runs.
- Mainframe Modernizationz/OS upgrades, COBOL and CICS modernization, API enablement, RACF security, and refactoring or replatforming paths including AWS Transform for mainframe.
04 / 08
Enterprise Platforms
We implement, upgrade and integrate Salesforce, Dynamics 365, TriZetto Facets and ERP. The senior engineers doing it track every vendor release.
Practice overview
- CRM SolutionsCRM implementation, integration and clean-up on Salesforce and Dynamics 365, with identity, consent and customer data designed in from day one.
- Salesforce ServicesSalesforce implementation, release readiness and Agentforce setup. We review Winter '27 changes, including Agentforce being on by default, against your org.
- Microsoft Dynamics 365 ServicesDynamics 365 Sales, Customer Service, Finance and Business Central. We implement them, and we plan updates now that Microsoft has retired release waves.
- Healthcare Payer Platforms (Facets)TriZetto Facets configuration, member and provider data work, and the FHIR APIs CMS-0057-F requires from impacted payers by January 2027.
- ERP SystemsERP implementation, integration and migration on Dynamics 365 Finance, Business Central and SAP, with data migration planned around your close.
- Business IntelligenceReporting inside Salesforce, Dynamics 365 and ERP, from Tableau dashboards to embedded Power BI, with security that matches the app.
- Workflow AutomationPower Automate, Power Apps and Copilot Studio agent flows built and governed, with service accounts, connectors and data loss policies under control.
- Insurance PlatformsCertified engineers for P&C carriers. Guidewire InsuranceSuite and Duck Creek implementation, cloud migration and upgrades, plus integrations and staffing.
- Banking & Capital Markets PlatformsMurex MX.3, Calypso and Temenos Transact upgrades, integrations, environment management, testing and specialist staffing for banks and trading firms.
- Healthcare Provider PlatformsEpic, Oracle Health and InterSystems integration, FHIR APIs, interface engines, data platforms, identity and staffing for hospitals and health systems.
- HCM & Payroll PlatformsIntegration work on Workday, PeopleSoft HCM and SAP SuccessFactors. Workday Extend apps, PeopleTools upgrades, payroll interfaces and identity fed from HCM.
- IT Service & Operations ManagementServiceNow ITSM, ITOM Discovery, Service Mapping, Event Management and CMDB work, plus family upgrades and specialist staffing, by certified engineers.
- Intelligent AutomationUiPath, Power Automate desktop flows and ServiceNow RPA Hub automation, agentic orchestration, bot estate cleanup and support, by certified engineers.
05 / 08
Data & Analytics
Data strategy, engineering, modeling, governance and BI on Snowflake, Databricks and Microsoft Fabric, with access tied to your identity provider.
Practice overview
- Data StrategyYour data strategy starts from the decisions the business needs to make. It ends in a platform choice, operating model and first data products you can fund.
- Data EngineeringData pipelines for Snowflake, Databricks and Microsoft Fabric. We build with dbt, Fivetran and Airflow and test and deploy like application code.
- Data ModelingDimensional models, Data Vault 2.0 and semantic layers designed for Snowflake, Databricks and Fabric, using erwin, ER/Studio or SqlDBM.
- Data Governance & AccessWe provision Snowflake and Databricks Unity Catalog access from Okta or Entra ID groups, add masking and row filters, and keep the audit evidence.
- Data IntegrationIntegrate CRM, ERP, claims and SaaS data with managed connectors, change data capture, APIs and reverse ETL, with ownership defined for every field.
- Business IntelligenceWarehouse BI in Power BI or Tableau. We build governed semantic models, use Fabric's Direct Lake where it fits and take row-level security from identity groups.
- Advanced AnalyticsWe build forecasts, churn and propensity scores and customer segments on Snowflake or Databricks, then write results back into the CRM where people act on them.
06 / 08
AI & Machine Learning
AI strategy, generative AI and agents, governance, and machine learning models, built with scoped permissions and measured accuracy.
Practice overview
- AI StrategyRank AI use cases by value, data readiness and risk. Decide build or buy for each. Then scope the first one for production.
- Generative AI & AgentsWe build RAG applications, AI agents and MCP servers on Claude, OpenAI and open models, with agent identity, scoped OAuth tokens and approval steps.
- AI Governance & SecurityKnow which AI you run, then map controls to NIST AI RMF, ISO/IEC 42001, the EU AI Act and Colorado's ADMT law, and test the systems for security gaps.
- Machine Learning ModelsPredictive machine learning models for forecasting, churn, fraud and risk, built on Databricks, Snowflake or Fabric with registry and drift monitoring.
- Natural Language ProcessingNLP pipelines that classify, extract and summarize text from claims notes, emails and contracts, measured on labeled data and written back to your systems.
- Computer VisionComputer vision for defect detection, counting, OCR and safety monitoring. We go from labeling to edge deployment and check licenses and device identities.
- Neural NetworksDeep learning model design, fine-tuning and optimization in PyTorch, from LoRA fine-tunes of open models to quantized models for edge hardware.
- Forward Deployed EngineersOur engineers sit with your business team and ship AI workflows into production on your real systems, with evals, access controls and a handover.
- AI Adoption & EnablementGetting licensed AI tools used for real work, with role-based training, a ranked use-case portfolio, internal champions, usage telemetry and a usable AI policy.
- LLMOps & Model EvaluationEvaluation suites, tracing, release gates, cost controls and model upgrade testing for LLM applications and agents running in production.
- AI SecurityWe test AI assistants and agents for prompt injection, design their tool permissions, add leakage controls and review them against the OWASP LLM Top 10.
07 / 08
Internet of Things
IoT platform builds, device identity and certificates, industrial IoT security and edge computing, delivered by senior Cohash engineers.
Practice overview
- IoT PlatformsAWS IoT Core and Azure IoT Hub platform builds, device provisioning, X.509 certificate design and Azure IoT Central migration planning.
- Smart DevicesWe engineer connected products for device identity, secure updates and Matter support, and get them ready for the EU Cyber Resilience Act and UK PSTI.
- Industrial IoTCohash does OT and ICS security engineering for plants and pipelines. IEC 62443 zones and conduits, vendor remote access and OT identity.
- Edge ComputingEdge computing builds on AWS IoT Greengrass V2, Azure IoT Edge and Azure IoT Operations, plus runtime upgrades and edge identity.
08 / 08
Mobilize Talent
Cohash places and supports engineers in identity, enterprise platform and data roles, through direct hire, staff augmentation and team development.
Practice overview- Talent AcquisitionDirect-hire recruiting for IAM, Salesforce, Dynamics 365, Snowflake and Databricks roles. The technical screen is run by an engineer who does the job.
- Staff AugmentationContract identity, enterprise platform and data engineers who join your team, backed by Cohash practice leads. Clear onboarding, check-ins and exit terms.
- Talent DevelopmentHands-on training for your engineers on identity, Salesforce, Dynamics 365, Snowflake and Databricks, built around your own environment and roadmap.
- Consulting ServicesAssessments, architecture reviews and advice on identity, enterprise platforms and data, from senior consultants. Scoped up front, written up at the end.
- Hard-to-Find SkillsWe place niche platform engineers for Murex, Guidewire, Epic, RACF, SAP IS-U, ServiceNow ITOM and OT/ICS security. Contract, contract-to-hire or permanent.
- Onsite, Nearshore & Offshore DeliveryPut certified engineers onsite in the US, or nearshore on overlapping hours. Offshore teams work overnight, and handovers carry coverage across all time zones.
next step
Tell us what you're running. We'll tell you what we'd do first.
A 30-minute working session with a senior engineer. No slides.
useful to bring
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it