Trust depends on how you behave when nobody is checking.

Our commitment

JandaSec Ltd commits to acting with honesty, competence, independence and respect in the way we advise clients, build technology, handle information and conduct business.

Cybersecurity professionals can be given unusual levels of trust: access to sensitive information, knowledge of weaknesses, influence over investment and risk decisions, and sometimes a role during difficult incidents. That trust carries responsibilities beyond simply staying within the law.

We expect our advice to be evidence-led, our limitations to be visible and our decisions to withstand reasonable scrutiny. Where commercial interest, technical enthusiasm or pressure conflicts with responsible professional judgement, ethical conduct comes first.

Aligned with current UK professional ethics

JandaSec's ethical commitments are informed by and aligned with the current ethical principles published by the UK Cyber Security Council , the professional body for the UK's cyber security sector.

We take account of both the Council's organisational ethical expectations and its Ethical Principles for Individuals. The individual principles were updated on 17 December 2025 and cover professionalism, fair business practices, honesty, inclusion, integrity, lawful behaviour, competence and responsible reporting.

The UK Cyber Security Council updated its Ethical Principles for Individuals on 17 December 2025. JandaSec has reviewed those updated principles and reflects their themes within this declaration.

JandaSec applies those themes in the context of our own work, responsibilities and operating model. This is not a claim of Council membership, endorsement, accreditation or permission to display an Ethical Mark.

• Ethical Declaration for Organisations
• Updated Ethical Principles — December 2025
• Ethical Scenarios

• Professional judgement

  We approach cyber security as a profession, not a performance. Advice should be thoughtful, respectful, evidence-led and appropriate to the organisation receiving it. We will challenge assumptions where needed, but challenge should improve decisions rather than demonstrate superiority. We will communicate clearly with boards, executives, engineers and other stakeholders without using complexity as a barrier.

• Honesty and evidence

  We will distinguish what we know from what we believe, what has been evidenced from what has been asserted, and what is an assumption from what is a fact. We will not create fear to sell work, exaggerate a finding to make it sound more serious, or provide unsupported reassurance because that is the easier message. Where evidence is incomplete, we will say so.

• Fair commercial behaviour

  We will describe our own services and capability accurately. We will not make false or misleading claims about competitors, products, suppliers or alternative approaches. Commercial objectives do not justify distorted risk advice. Recommendations should be driven by the client’s needs, business context and evidence rather than by a hidden incentive to sell additional work or technology. Where a commercial relationship could reasonably influence our advice, we will make that relationship visible.

• Independence and conflicts of interest

  Professional judgement can be compromised when competing interests are hidden. We will identify and disclose actual or material potential conflicts of interest. Where a conflict cannot be managed without undermining the independence or credibility of the work, we will not pretend otherwise. In advisory work, the responsibility for management decisions remains with the organisation and its accountable leaders.

• Competence and limits

  We will be honest about what we know, what we can do and where specialist expertise is required. Breadth does not mean pretending to be the specialist in every discipline. Where an engagement requires skills outside the agreed scope or our competence, we will say so and, where useful, work transparently with an appropriate specialist. Professional development is continuous.

• Confidentiality and trust

  Access to confidential information is a responsibility, not an asset to be reused. We will protect client, partner and business information according to its sensitivity, contractual obligations and legitimate purpose. Information learned through one engagement will not be casually transferred into another. Confidentiality does not justify concealing unlawful activity or preventing responsible reporting where reporting is legally or ethically required.

• Responsible technology and AI

  New technology does not remove human accountability. JandaSec uses automation and AI where they improve analysis, engineering or security work, but tools do not become the decision-maker simply because they are capable of producing an answer. Sensitive information is not placed into tools without considering confidentiality, purpose and controls. AI-assisted output is reviewed by a human, and material decisions remain the responsibility of people.

• Responsible reporting

  Security professionals will sometimes discover weaknesses, threats or behaviour that other people would prefer not to discuss. We support responsible reporting: concerns should be raised accurately, in good faith, through an appropriate route and with enough care to avoid creating unnecessary harm. We will not exploit access to a vulnerability or confidential weakness for personal advantage, publicity or leverage.

Respect and inclusion

Technical competence does not excuse poor professional behaviour. JandaSec expects people to be treated with dignity and judged on their actions, competence and contribution. Discrimination, exclusion, bullying or disrespectful behaviour are inconsistent with the standards we expect in professional work. Challenge can be direct without becoming personal.

Lawful and authorised work

Cybersecurity work can involve capabilities that would be harmful or unlawful without clear authority. JandaSec will operate within applicable law, contractual authority and agreed scope. Access to systems, data or testing capability is not treated as permission to exceed that authority.

Where the legal position is uncertain or specialist interpretation is required, we will seek appropriate advice rather than present cyber expertise as legal expertise.

Client interests and wider responsibility

We work in our clients' interests, but professional responsibility is not the same as agreeing with every requested outcome. Advice that would mislead a board, conceal a material risk, misrepresent evidence, create avoidable harm or require us to act unlawfully is not made acceptable by a commercial instruction.

Where client interests, contractual obligations, public interest and professional duties pull in different directions, the situation should be surfaced and handled consciously rather than hidden.

• Clear boundaries

  We explain scope, assumptions and what the work does not cover.

• Evidence before confidence

  Material conclusions should be supported by evidence appropriate to the decision.

• No fear-based selling

  Risk is described clearly without manufacturing urgency to create work.

• Honest limitations

  We say when further specialist testing, legal advice or other expertise is needed.

• Confidential by default

  Client information stays within its legitimate engagement context.

• Actions over theatre

  The purpose of assessment is better decisions and real improvement, not impressive-looking reports.

Partners and specialists

JandaSec sometimes works with trusted specialists where an engagement needs capability outside our own role or agreed scope.

We expect partners working through or alongside JandaSec to behave consistently with these principles: be honest about competence, respect confidentiality, remain within authority, report concerns responsibly and make commercial interests clear.

The use of a partner should be transparent to the relevant client. We do not pretend specialist work was performed by JandaSec where it was not.

Raising an ethical concern

If a client, partner or other stakeholder believes JandaSec has fallen short of this declaration, we want the concern raised. Concerns can be raised through the Contact route. They will be considered seriously, with appropriate confidentiality and without treating reasonable challenge as an inconvenience.

Where a concern relates to a potential security vulnerability in JandaSec systems, use the Vulnerability Disclosure route instead so that technical information can be handled safely. For how JandaSec protects information in practice, see Privacy and Security.

Ethical concerns involving third parties

Where an ethical concern relates primarily to another professional, supplier or organisation, JandaSec will consider the appropriate route according to the facts and any relevant legal, contractual or professional obligations.

The UK Cyber Security Council publishes ethical scenarios and a breach process relevant to its own professional framework. Those resources may be useful context, but JandaSec does not present the Council as a general complaints body for every commercial disagreement.

Ethics needs maintenance too

Ethical standards are not useful if they become a page that nobody revisits. JandaSec reviews this declaration at least annually and when there are material changes to our services, technology, professional standards or operating model.

We also review relevant developments from the UK Cyber Security Council and other authoritative sources so that our published commitments continue to reflect current professional expectations.

Last reviewed: 13 October 2026

Do the work in a way you can defend.

Good cyber security depends on trust, and trust is fragile. JandaSec's aim is straightforward: give advice we can justify, protect what is entrusted to us, be honest about uncertainty and limits, make conflicts visible, and behave in a way we would be comfortable explaining to a client, a board, a peer or the public.