Know exactly where you stand, and what to fix first.

Scope of workp. 2

Includes

• Current-state review of the whole program against the framework you answer to
• Maturity scoring on a recognised whole-program model (NIST CSF 2.0 or C2M2)
• Risk analysis across the enterprise, your cloud, and your vendors
• A prioritised, risk-ranked gap register with a costed roadmap

Best for a first, complete read of where the program stands.

Scope of workp. 2

Includes

• Gap assessment of the program against one named standard: ISO 27001, SOC 2, or a sector regime
• Control-by-control review of what is in place against what the standard requires
• An honest read on the time and effort to certification

Best for teams heading into a first certification or surveillance audit.

Scope of workp. 2

Includes

• Vulnerability management, scored against the SANS VMMM
• Application security, scored against BSIMM or OWASP SAMM
• Security operations, scored against the SOC-CMM
• A focused, function-level maturity rating and improvement path

Best for a deep read of one capability, not the whole program.

Scope of workp. 2

Includes

• Shadow-AI discovery: the tools, models, and assistants already in use
• Data and model-pipeline exposure review, from training data to outputs
• Third-party AI risk across the vendors and features you already rely on
• Findings mapped to ISO/IEC 42001 and the NIST AI RMF

Best for organisations whose AI adoption is running ahead of governance.

Scope of workp. 2

Includes

• IR plan and playbook review against how your organisation actually runs
• A tabletop exercise with your leadership and technical teams
• Recovery validation: backups, continuity, and the path back to normal
• A clear read on insurer and reportable-incident expectations

Best for teams whose IR plan has never been rehearsed.

Scope of workp. 2

Includes

• Configuration and posture assessed against the CIS Benchmarks and the CSA Cloud Controls Matrix
• Identity, network, and data-exposure review across your accounts
• ISO 27017 and 27018 in scope where the cloud handles personal data
• Findings ranked by exploitability and blast radius

Best for cloud-first teams unsure what their accounts expose.

Scope of workp. 2

Includes

• Inventory and tiering of your vendors by the access and data they hold
• Risk review of your critical and high-tier suppliers
• A repeatable scoring method you can keep using

Best for organisations with a growing or unmapped vendor estate.

Scope of workp. 2

Includes

• Hands-on testing of network, application, or cloud, scoped to your estate
• Run to recognised methodologies: OWASP for applications, PTES and MITRE ATT&CK for adversary emulation
• Delivered by certified offensive-security practitioners
• Findings with clear reproduction steps and remediation guidance

Best for teams needing technical proof, not just a paper review.