Cybersecurity risk consulting

An assessment of where a breach would hurt your business, and which fixes a board should fund first.

Inside the assessment

Most reviews touch some of the areas set out here, chosen once you have named what matters most to protect and what set off the concern.

What a breach would cost: The money and the standing a breach would put at risk, set out in terms a board can weigh.
Where the exposure sits: The systems and data whose loss would hurt most, and how an attacker would reach them.
How likely each loss is: Which risks are plausible against your own company, with a note on how sure each judgement is.
What to fix first: The small number of changes that reduce the most risk for the least disruption, in the order to make them.
Suppliers and partners: The access third parties hold into your systems and data, and what their own exposure makes yours.
People and process: The habits and arrangements that let a technical control be worked around, read from how the business actually runs.
Penetration testing: Testing the systems that matter most the way an attacker would, to confirm where the exposure really is.

An assessment the board can act on

A cybersecurity report often lands on a board as a long list of colour-coded findings, with no clear line from a finding to a loss the business would feel. Directors are asked to approve spending without being told what each item would actually cost if it went wrong, or how likely it is against their own company. The result reads as technical housekeeping, and the hardest questions get deferred to a specialist nobody in the room can argue with.

The assessment here starts from what the company would lose, in money and in standing, then works back to the systems that carry that loss and the routes an attacker would take to reach them. Each risk is weighed by how plausible it is against your own company, and where the evidence is thin, the report says so.

The point of the exercise is the order of the fixes. A list of everything that could be improved tends to sit unread, so the work names the few changes that cut the most risk for the least disruption and puts them in sequence, with the reasoning written where a director can follow it.

How to start

The brief

Say what you most need protected and what has prompted the review. Note who on the board will act on the findings.

Confidentiality first

A non-disclosure agreement can be in place before you send anything sensitive about your systems.

Who does the work

Amos Weiskopf has built and run software systems for more than twenty years, so he reads security risk from the engineering side.

Questions buyers ask

What is cybersecurity risk consulting?

It is an assessment of your cybersecurity risk written for a board, setting out what a breach would cost and which fixes to make first. The reasoning behind each judgement is written down so you can check it.

How much does cybersecurity risk consulting cost?

That depends on how many systems and suppliers are in scope. The price is agreed after the written brief.

Do you run penetration tests?

Yes. Penetration testing can be part of the engagement, and the assessment shows where a test is most worth running.

Will our systems information stay confidential?

Yes. A non-disclosure agreement can be signed first, and nothing is passed to an outside party without your agreement.

How is this different from a compliance audit?

A compliance audit checks whether you meet a standard. This assessment asks what you would actually lose and how likely that is, then sets the fixes in order. The two can point in different directions.

Can the board act on the report directly?

That is the purpose. Findings are stated as losses the business would feel, ranked by how much risk each fix removes, so directors can decide what to fund without needing a specialist to translate it for them.

Engagements by written brief.

Work begins from a documented problem statement, not a sales call.

Write a brief Or book a meeting