Cyber Security
Most assessment reports fail at the same place: the finding is correct, the evidence is thin, the owner is unclear and nobody can say what “fixed” looks like. I wrote a long series that didn't — assessments good enough that underwriters priced capacity off them — and then moved on to building the tooling that makes the careful version repeatable without me in the building. Security assessment, gap analysis and remediation roadmaps, delivered across insurance, legal and regulated environments and aligned to the frameworks an organisation is accountable to — written so engineering can act on every finding without a translation layer, and now largely productised.
The work
Structured review against NIST CSF 2.0, C2M2, CIS 18 or ISO/IEC 27001 — evidence-based, sampled where sampling is honest, and explicit about what wasn't looked at.
Findings carry evidence, owner, cost band and a definition of done.
Where you are, where the framework says you should be, and the shortest sequence of moves that gets you there without a 14-month transformation programme.
Ordered by curve movement per dollar, not by which control is easiest to tick.
The security questionnaire your vendor sent you, answered with judgement instead of dread — plus the two follow-ups that actually matter.
Includes the “this answer is a red flag” translation service.
A second pair of eyes on the design before it's a migration: identity, segmentation, backup topology, cloud boundaries, and the paths an attacker would prefer.
Feedback delivered as options with consequences, not preferences.
Hands-on, side-by-side work on the top findings — baseline changes, detection coverage, privileged access cleanup — with the changes written down as you go.
For teams that want the gap closed, not just documented.
Scenario walkthroughs using your real topology, your real vendors and a moderator who will not let the room agree too quickly.
Output: who decides what, discovered before the incident does.
Frameworks
Choosing a framework is a governance decision, not a safety one. Here's the honest trade-off sheet.
Happy to assess against a framework you're already contractually tied to, however eccentric. I'll be quiet about it. Once.
Assessments can be delivered against whatever framework is already mandated — by contract, by a regulator, or by internal policy.
How an assessment runs
One list, sent once. If it takes you more than a week to gather, my list was wrong.
The people who run the systems, not the org chart. Short sessions, no slide decks requested.
Configuration, identity paths, backup topology, logging coverage — sampled and documented.
Each with evidence, blast radius and a severity expressed in what it would cost, not how scary it sounds.
Sequenced by cost and curve movement, with a re-test plan so closure is provable.
Two trades
Assessment answers “what's wrong”. Quantification answers “so what”. They're sharper together and useful apart.