Scope and context
- Which services must remain available?
- Where do customer and payment data flow?
- Who is inside and outside the scope?
- What assumptions do you need to state?
New collection · Atlantic coast
Made to
follow the light.
Lightweight frames, polarised lenses and days made to last longer.
Free delivery over €8030-day returns
NEW RELEASEOctober sun20% off a second frame · demo
UV400 PROTECTION✦DESIGNED IN DUBLIN✦EUROPEAN DELIVERY✦2026 COLLECTION✦UV400 PROTECTION
Most wanted
Choose your sunshine.
A simulated commercial storefront: products go into the bag, but the journey ends before any personal or payment data is requested.
Launch offer · demonstration
Two looks.
One whole summer.
Buy one frame and get 20% off the second. This promotion is part of the prototype only and does not create real orders.
View collectionFrom click to doorstep
01DiscoverThe Solas Shades
02BuyShopifly Lab / PayFriend Lab
03OrderThe Solas Shades
04Pick & packLiffey Fulfilment
05DeliverParcelRoute Lab
Academic access
Want to look behind the storefront?
Open the separate learning layer to inspect evidence, scenarios and security questions without changing the shopping experience.
Security lab mode
Now look behind the storefront.
Every step depends on people, accounts, apps and partners. Select a point to inspect a case-file fact and the questions it raises. You decide the risk and the response.
IdentityTechnologyProcess
Interactive scenario
09:40 — “Your payments will be suspended”
Priya receives an email that imitates Shopifly Lab and demands urgent verification. What should happen next?
?
Choose a response to see which questions it raises.
The padlock proves
Private connection. Data in transit is encrypted.
Domain identity. The certificate was issued for this address.
The padlock does not prove
- that the business is honest
- that the shop is free of malware
- that every internal account is secure
Trust is not security
Beautiful outside. Vulnerable inside.
HTTPS protects information in transit. It does not fix reused passwords, stale access, over-privileged applications or fragile processes.
Case-file evidence
Build your own risk picture.
These are observations from the fictional case file, not finished risk statements. Connect each asset, threat actor, vector and vulnerability yourself.
Assignment workbench
Turn observations into your own plan.
Use these prompts to structure your investigation. The site does not provide ratings, control selections, costs or a finished roadmap.
Risk picture
- Which threat actors fit this business?
- What vectors could each actor use?
- How would you justify likelihood?
- What would impact mean to the founder?
Controls and roadmap
- Which controls trace to each risk?
- Who can realistically own each action?
- What fits the €15k annual budget?
- What will you defer and explicitly accept?
Academic boundaryYou make the decisionsUse the evidence, module material and cited sources to support your own conclusions.
Your investigation