Define the decision
Clarify whether the work must support investment, assurance, regulation or a wider roadmap.
Insights
Practical cybersecurity guidance for better decisions.
Business-focused guidance to help management and technical teams ask better questions, prepare useful evidence and choose the right next step.
Independent perspective · Clear questions · Actionable guidance
Seven steps to a useful cybersecurity risk assessment.
A good assessment connects business value, credible threats, control evidence and practical treatment decisions.
Set scope and context
Identify critical services, systems, users, locations, third parties and constraints.
Gather evidence
Review architecture, configuration, policy, logs, ownership and actual operating practice.
Prioritise treatment
Give every action an owner, dependency, target outcome and realistic sequence.
Communicate for action.
Management view
Explain business exposure, priority and decisions without unnecessary technical detail.
Technical evidence
Give implementers the evidence and context needed to remediate.
Measurable follow-through
Track ownership, target outcomes and validation—not only task completion.
Clear outcomes
Questions organisations commonly face.
The right starting point depends on the decision you need to make.
- Assessment or penetration test?
- What makes regulatory evidence useful?
- When does vCISO support help?
- Which risks should be treated first?
- How should improvement be measured?
Need guidance shaped around your own environment?
Use these insights as a starting point, then discuss the specific decision or risk.