How we work
From understanding the problem to a practical decision.
Every engagement starts with understanding your business, environment and objective. We then connect relevant information, identify risks and blind spots, set priorities and define next steps.
First, we understand
Every risk has a context.
Before analysis begins, we seek to understand how your system actually works. We examine business operations, people, processes, premises, technology and safeguards to the extent relevant to the problem.
We gather relevant information
Data before conclusions.
Discussions, documentation, existing procedures, available data and direct observation provide a basis for analysis. We connect information before reaching conclusions.
We identify risks
Where could the system fail?
We identify threats, vulnerabilities and situations that could endanger people, assets, operations or continuity. We pay particular attention to relationships between system elements, because problems often arise at their interfaces.
We look for blind spots
What is not apparent at first glance.
Some risks remain unnoticed when each area is considered separately. We look for weaknesses arising between people, processes, technology, the physical environment and the organisation.
We determine what matters
Not all risks are equal.
We do not stop at a list of problems. We focus on what may matter most to your business and set priorities based on likelihood, consequences and existing protection.
We turn findings into measures
Analysis has value when it leads to a decision.
We use findings to define practical recommendations and measures. Proposals must fit the actual risk, your environment and your capacity to implement them.
How does an engagement begin?
Discussion
We learn about your problem and objective.
Defining the scope
We agree what needs to be analysed.
Work
We deliver the agreed engagement.
Findings
We present key results and priorities.
Next steps
We define recommended measures and options for continued cooperation.
We do not view security in isolation.
Where relevant to the engagement, we connect different perspectives — security, risk assessment, analysis, forensics, technology and organisational processes.
We examine the relationships between system elements, not just individual areas.
Frequently asked questions
No. You only need to know the problem you want to address. We define an appropriate approach through discussion.
It depends on the engagement. Premises and the physical environment may require direct observation, while some analyses can be completed remotely.
The scope depends on the size of the system, number of locations, available information and objective of the analysis.
You receive the analysis results, defined priorities and recommended measures within the agreed scope.
Yes. Where needed, we can support implementation of recommendations, further analysis, training and subsequent improvement phases.
Not sure where to start?
Let us start with the problem you want to solve.
We will discuss your situation, define what is needed and suggest the most sensible next step.
AN EXAMPLE OF OUR APPROACH
See our approach through one example.
The demonstration shows how we move from observation to verification, decision and understanding the consequences. Try the “Unauthorised Access” scene.
Try the demonstration →No account or mandatory email. A fictional situation for learning.