Saepio, the Buckinghamshire cyber security services firm, has bought Remitech, a Borehamwood consultancy that looks after identity, device management and workplace technology for cloud-native fintechs. It is Saepio’s second acquisition after pen testing specialist Ruptura, and it shows clearly how mid-market UK cyber providers are trying to grow by buying smaller firms.
What happened
Saepio has announced that it has acquired Remitech. The announcement on Saepio’s website carries a London dateline of Monday 2 November, but the deal became public on 10 November, when BusinessCloud reported it. Neither company has disclosed the price or the deal structure.
Remitech was founded in 2018 by its chief executive, David Remington. It made its name supporting “cloud-born” businesses, especially fintechs that run on Apple hardware and modern SaaS workplace tools. Its core skills cover identity, workplace technology and mobile device management (MDM). Saepio says the consultancy has since become security-led, which is what made it a fit.
Saepio is based in High Wycombe and offers a broad mix: advisory and consulting, managed security, penetration testing and the resale of security software. Its customers are lower-enterprise, mid-market and scale-up organisations. Before Remitech it bought Ruptura, an offensive security firm whose founder, Tom Heenan, became Saepio’s Director of Offensive Security. Chief executive Amir Nooriala says he wants Saepio to become the UK’s leading independent cyber security services business, and to be the place where smaller, high-quality security firms go to scale.
Remington’s message to customers is about continuity. He says clients “keep the people and the standards they know” while gaining access to Saepio’s wider team.
The detail
The two deals fill different gaps. Ruptura brought offensive capability: Saepio says its team placed first in the UK in Hack The Box’s capture the flag competition in 2023 and 2024. Ruptura was also a Cyber Essentials and Cyber Essentials Plus certification body. Saepio has put that alongside its own managed governance, risk and compliance service (M-GRC), which tracks control status against security frameworks in one dashboard instead of spreadsheets.
Remitech brings the defensive and operational side, which pen testers usually only see from the outside. Identity platforms, MDM consoles and the configuration of collaboration suites are now where most small and mid-sized organisations actually enforce security policy. For a fintech running on laptops and SaaS, with little on-premises infrastructure, the identity provider and the device management tool effectively are the perimeter.
Taken together, Saepio can now advise a client, configure its identity and endpoint estate, test it, certify it against Cyber Essentials and then monitor compliance. Neither company has said how many staff moved across or how the businesses will be combined beyond keeping Remitech’s client relationships.
Why it matters for UK organisations
The UK cyber services market is crowded and fragmented. There are a few large listed players and integrators, and below them many specialist consultancies, often with fewer than fifty people and built around one or two founders. For several years the usual answer to that fragmentation has been buy-and-build: a platform company acquires niche firms, adds their skills to its catalogue and sells more services to each customer. Saepio has said plainly that this is its strategy.
For buyers this has upsides. A mid-market organisation that has dealt with a pen testing firm, a separate Cyber Essentials assessor and a third outfit managing devices can deal with one supplier, one contract and one account team. Joined-up providers can also close the gap between finding problems and fixing them. Too often a test report lists identity and device weaknesses that nobody in the client organisation has the time or skills to fix.
There are risks too. Consolidation concentrates privileged access. A provider that manages your identity tenant and MDM, holds your test findings and assesses your certification knows a great deal about your weak points, and its own security becomes part of yours. Supply chain compromise through managed service providers is a well-documented attack route. The NCSC has long pushed organisations to understand and limit what their suppliers can reach. Independence is a fair question as well: when the same group configures and certifies an estate, customers should ask how assessment is kept separate from delivery.
Expert view
In my experience, the most damaging findings in modern engagements rarely come from exotic exploits. They come from identity: stale accounts, weak conditional access rules, over-privileged admin roles, unenrolled devices and help desk processes that an attacker can talk their way through. A consultancy that has spent years running identity and MDM for cloud-first fintechs has seen those problems up close. That is a natural match for an offensive team, and on paper the deal makes sense.
What makes these roll-ups work is less glamorous: whether the combined business can keep senior practitioners after any earn-outs end, and whether quality holds as headcount grows. Small specialist firms are often valued for the specific people who do the work. Remington’s emphasis on clients keeping familiar people suggests both sides understand that.
When we test organisations that rely on one supplier for several functions, I want clear answers on how that supplier’s staff authenticate into the client’s environment, where credentials are stored and what happens to that access if the relationship ends. Clients of any firm that has just been acquired should ask those questions now, while contracts and onboarding are being looked at anyway.
What to do now
- Review supplier access after any acquisition. If a provider you use changes ownership, list every account, API token and delegated admin relationship it holds in your identity provider, MDM and cloud tenants. Remove anything that is not needed. This maps directly to the Cyber Essentials user access control requirements.
- Require strong authentication for supplier admins. Insist on phishing-resistant multi-factor authentication and named, individual accounts for anyone managing your estate. Shared logins should not survive a merger.
- Re-check contracts and data processing terms. Confirm which legal entity now processes your data, where it is held, and whether subcontracting or notification clauses have changed.
- Keep assessment independent where it matters. If one group both runs and certifies your controls, consider an independent test or Cyber Essentials Plus assessment from time to time to keep the assurance credible.
- Treat identity and MDM as your perimeter. Whoever your supplier is, check device compliance policies, secure configuration baselines and patching, in line with the Cyber Essentials secure configuration and security update management controls.
Bottom line
Saepio buying Remitech is a modest deal on paper, with no price disclosed. Still, it is a clear example of where the UK mid-market cyber services sector is heading: platforms built from specialist firms, offering advice, implementation, testing and certification under one brand. For customers that can mean simpler buying and better follow-through on fixes. It also puts more trust in one supplier, so the sensible response is to welcome the convenience and tighten the controls on who can reach your systems.
