Threat-led risk assessment
Scenario modelling grounded in the techniques actually used against your sector, quantified in financial terms so security investment can be argued on the same basis as any other capital decision.
Loading page content
Executive summary
Security budgets are spent evenly and attacked unevenly. This engagement identifies the handful of scenarios that would cause material loss, quantifies them in financial terms your CFO can validate, and builds controls that break those specific attack chains. Every rupee of spend traces to a scenario, and every scenario traces to a number.
Security budgets get spent evenly and attacked unevenly. The organisations that come through an incident well are rarely the ones with the most tools; they are the ones that understood which five scenarios would cause material damage and engineered specifically against them.
We start with your crown jewels and your realistic adversaries — ransomware operators, business email compromise, insider misuse, supply-chain compromise, credential-stuffing at scale — and work backwards to the controls that break those chains.
What you get is a security programme with a defensible logic: every control traces to a scenario, every scenario traces to a business impact, and every rupee of spend can be explained to a CFO.
The pattern we see repeatedly
Each capability below is a discrete workstream with its own owner, deliverables and definition of done.
Scenario modelling grounded in the techniques actually used against your sector, quantified in financial terms so security investment can be argued on the same basis as any other capital decision.
Identity, network, endpoint, data and application layers assessed against a zero-trust target state, with a phased roadmap that respects what you have already bought.
Use-case-driven detection coverage mapped to MITRE ATT&CK, log source rationalisation, alert tuning, and runbooks that turn an alert into a decision in minutes.
Privileged access design, joiner-mover-leaver automation, MFA and conditional access strategy, and periodic access certification that people complete honestly.
Asset-aware prioritisation that ranks by exploitability and business exposure rather than raw CVSS, with SLAs your engineering teams can actually meet.
Playbooks, escalation trees, forensics retainers, communications templates and tabletop exercises run with your executive team, not just your SOC.
Each benefit is stated with the commercial consequence attached, because a capability without a consequence is a feature list.
Threat scenarios quantified as annualised loss-exposure ranges, so control spend is compared against the exposure it removes.
Converts a security budget conversation into a capital allocation decision with the same evidence standard as any other.
Use-case-driven coverage mapped to MITRE ATT&CK with log sources rationalised and alerts tuned to your estate.
Triples coverage of relevant techniques while reducing alert volume, so analysts act instead of triaging noise.
Playbooks, escalation trees and a named incident commander, rehearsed with your executive team rather than only your SOC.
Removes the authorisation delay that causes most regulatory reporting windows to be missed.
Independent assessment of an estate that typically holds overlapping products, several only partly deployed.
Cancelled and consolidated licences identified as part of the assessment, before any new spend is approved.
Phases overlap deliberately — design begins before assessment closes, so the programme does not stall waiting for a document to be signed off.
Weeks 1–4
Current-state assessment across governance, identity, infrastructure, applications, data and operations, benchmarked against NIST CSF 2.0 and sector peers.
Weeks 3–6
Crown-jewel identification and threat scenario modelling, translated into loss-exposure ranges your finance function can validate.
Weeks 6–8
Control gaps ranked by risk reduction per rupee, producing a roadmap with clear owners, sequencing and dependency mapping.
Weeks 8–32
Delivery support for the highest-value initiatives — architecture, tooling, process and detection engineering — embedded with your teams.
Ongoing
Continuous control validation, purple-team exercises and quarterly board reporting that tracks residual risk over time.
Named artefacts, listed in the statement of work. If it is not on this list, we will tell you before you sign rather than after.
Sector constraints change the delivery approach more than they change the obligations. These are the sectors this methodology is built around.
Fixed fee for defined scopes, retainer for ongoing services. We do not price advisory work on time and materials, because that misaligns our incentive with your outcome.
4 weeks
Organisations that need to know where they stand before planning
Commercial basis: Fixed fee
8–32 weeks
Organisations executing a funded security improvement plan
Commercial basis: Fixed fee per workstream
Rolling
Organisations that need control effectiveness proven over time
Commercial basis: Monthly retainer
Every proposal states what is included, what is not, and what would trigger a change request. If the scope we recommend is smaller than the one you asked for, we will say so.
One implementation, cross-mapped. Each framework below links to its own obligations and control domains.
Specific answers about scope, timeline and what we will and will not do.
Ask a practitioner directly. First responses come from the person who would run your engagement, within one business day.
Ask a questionTurn data protection law into working product behaviour.
We map where personal data actually lives, rebuild consent and rights flows into your product, and leave you with a privacy programme that survives an audit and a board question.
Explore capabilityOne operating model for privacy, security, risk and AI accountability.
We design the committees, policies, decision rights and reporting lines that let trust obligations be managed as one programme instead of four competing ones.
Explore capabilityCertification without the eighteen-month scramble.
Readiness, implementation and audit support for ISO 27001, ISO 27701, ISO 42001, SOC 2 and PCI DSS — run as a project with dates, owners and a definition of done.
Explore capabilityCombining capabilities reduces cost — the second framework typically lands at about half the price of the first.