Assent Cyber is an information security consultancy. We measure the whole programme first, then say what to do about it in the order that reduces the most risk for the money.
Scroll to cross the line ↓
The line
Left of bang comes from the Marine Corps' Combat Hunter program. Plot an incident on a timeline. The explosion is bang. Left of it you have time, choices and leverage. Right of it you have none of the three. Here is one incident, plotted.
Left of bang
Someone leaves. Their account does not. Multiply by three years of leavers and the number of live credentials stops matching the number of people who work here. Cost of fixing it today: an afternoon, and somebody willing to own the list.
Left of bang
The job runs nightly and reports success every morning. Nobody has restored from one. Until somebody has, a backup is a claim rather than a control, and proving it takes a morning.
Left of bang
The tool fires correctly. It goes to a shared mailbox, or a channel, or a person who left in March. Detection was never the missing piece. A name against it was.
Right of bang
Hours now, not afternoons. Somebody is deciding what to disconnect on incomplete information, at speed, probably at night, and every option on the table costs the business money.
Right of bang
Seventy-two hours to the ICO where personal data is involved. Customers, insurers and the board all want the same answer at once, and nobody has it yet.
Right of bang
The questions are the ones from the left of this line. Who owned it. When did you know. What had you tested, and when. Those answers were cheap to buy three screens ago.
The assessment
A facilitated review of the entire programme: people, process, technology, and the decisions behind all three. Four to six weeks, fixed fee, nothing to install. Five domains are scored.
The output
One number the board can hold onto, and the finding list behind it that the team can work through.
Controls exist, most of them bought after something went wrong. Nobody in the building could tell you what is covered and what is not.
The score is the diagnostic, not the goal. Nobody should be aiming at 1000. The right score is the one the business has consciously decided to pay for.
The work
The assessment decides what the work is, and sometimes it decides the answer is very little, and not from us.
Bangline Assessment4–6 weeks, fixed fee
The front door. A facilitated review of the whole programme, ending in a score, a ranked list of findings, and a readout written for the board.
Roadmap & programme build12–24 months
Findings ranked by risk reduced per pound, sequenced into a plan with owners and a budget the finance director can read.
Fractional CISOMonthly retainer
Programme ownership, board reporting, vendor decisions and escalation, for organisations that need the function without the headcount.
Incident readinessProject or retainer
A response plan, tabletop exercises run against your real environment, and a standing number so the first call is never a cold one.
Compliance readinessISO 27001, Cyber Essentials, NIS2, DORA
Mapped out of the assessment rather than run as a separate project. Most of the evidence you need already exists somewhere.
Commitments
These are constraints rather than values. They cost us revenue, which is the only reason they are worth printing.
No resale, no referral fees, no product revenue. There is nothing to buy from us, so our recommendation cannot be bought.
Every domain and scoring criterion is public. You can grade yourself before you ever call us, and some of you should.
No change orders on an assessment. If we scoped it wrong, that is ours to absorb.
If we help build the programme, someone independent certifies it. We will introduce them and then stay out of the room.
Not only to the person who hired us. This work fails when the results stop with whoever is most embarrassed by them.
Contact
First contact is a conversation, not a scoping call with a proposal attached. If the honest answer is that you do not need us yet, we will say so.