Advisory & assurance
Cybersecurity Risk Assessments
Identify vulnerabilities and prevent potential cyber threats. Every finding states the threat, the exposed asset, the existing control, the residual risk and the decision you are being asked to make.
The problem
A rating of "high" is not a decision.
Risk registers fill up with colour-coded rows that nobody can act on because the reasoning behind each rating was never written down. When the board asks why an item is high, or why it has been high for two years, there is no answer that survives the follow-up question.
We rate risk against a documented methodology that can be re-run next year and produce comparable numbers. That makes the register a management tool rather than an artefact produced for an auditor and then abandoned.
Methodology
Evidence in, decisions out
Asset & context
Establish what matters: critical systems, personal data holdings, revenue-bearing processes, regulatory dependencies and the suppliers they rest on.
Threat modelling
Credible threat actors and scenarios for your sector and exposure, not a generic list. Ransomware, business email compromise, insider misuse, supply-chain compromise, data exfiltration.
Control evaluation
Interviews, document and configuration review, sampling, and targeted technical validation to confirm that a control described as implemented actually operates.
Risk & roadmap
Inherent and residual risk stated with the reasoning, each mapped to an owner, a treatment option and a cost of treatment so the decision can be funded or accepted knowingly.
Assessment domains
- Identity, access management and privileged access
- Network architecture, segmentation and perimeter exposure
- Endpoint, server and mobile device protection
- Cloud configuration, tenancy separation and key management
- Application security practice and the software supply chain
- Logging, detection, alerting and response capability
- Backup, restoration and business continuity testing
- Third-party, outsourcing and concentration risk
- Physical and environmental controls where relevant
- Security governance, policy and awareness
Frameworks we map findings to
Findings are expressed in your own language first, then cross-referenced so the same piece of work satisfies several reporting obligations.
- ISO/IEC 27001:2022 Annex A controls
- NIS2 Article 21 risk-management measures
- DORA ICT risk-management requirements for financial entities
- Article 32 GDPR security-of-processing expectations
- CIS Critical Security Controls v8
- NIST Cybersecurity Framework 2.0 functions
Limitations you should understand before engaging
An assessment is a point-in-time professional judgement. Cybersecurity assessments identify and prioritise selected risks based on the agreed methodology. They may include interviews, document review, configuration review, sampling, technical testing or analysis of third-party information. An assessment is not a promise that an organisation is secure or that every vulnerability, threat, misconfiguration or future attack will be detected.
Risk ratings are professional judgements made using the evidence and assumptions available during the assessment. Clients remain responsible for deciding which recommendations to implement, the order of implementation, and the level of risk they are prepared to accept. Where we rely on information supplied by you, we may do so without independently verifying every statement, and the report will record the reliance.
Deliverables reflect conditions at the time of preparation and may become outdated because of changes in law, guidance, technology, personnel, suppliers, threats, business activity or processing operations. A report is not a continuing warranty. See sections 7, 11 and 23 of our Terms of Service.
Risk assessments
Give the board something it can act on.
Risk stated as a decision, with the reasoning attached and a treatment cost beside it.