Case studies
Evidence, not anecdotes.
Client names are withheld unless a client has given written permission. The numbers are real.
Professional services · Three-lens assessment
A regional law firm: from “we think we’re exposed” to a single, defensible plan.
The challenge
Leadership knew the firm carried cyber exposure but couldn’t say where it was concentrated, how mature its controls really were, or whether the firm’s growing use of AI tools was governed at all. They needed answers they could act on, and defend to clients and insurers.
The approach
- Vulnerability Risk Scoreboard across 800+ hosts, weighted 0–100 per host
- SOC 2 Control Maturity Review across 11 Trust Services criteria
- AI Risk Maturity Assessment across 12 AI risk domains
800+
hosts scored on a 0–100 risk scale
~94%
carried zero actionable findings
1
asset held every critical-severity finding
2
AI risk domains with no documented controls
What we found
Exposure was concentrated, not widespread.
Roughly 94% of hosts carried zero actionable findings. A single server held every critical-severity finding and sat at the top of the 0–100 scale: one clear first priority instead of hundreds of competing tickets.
Fleet-wide fixes beat ticket-by-ticket remediation.
The most common findings, including deprecated TLS 1.0/1.1, outdated JavaScript libraries and unencrypted remote-access services, repeated across dozens of devices. A handful of baseline changes could close most open items.
Controls were strong in places and thin in others.
SOC 2 control maturity averaged about 70%. Access controls, system operations and availability scored at full maturity, while governance and internal communication lagged.
AI adoption had outpaced AI governance.
AI risk maturity came in around 42%. Transparency and human oversight of AI outputs had no documented controls, while third-party AI vendor risk was already well managed.
The outcome
Leadership left with three independent scores, one prioritized remediation list, and an interactive risk scorecard they could revisit as fixes landed, instead of a raw scan export. The first move was obvious: remediate one server and retire deprecated protocols fleet-wide.
Talk to a partner, not a sales team.
A 30-minute confidential conversation to understand what’s at stake and whether we’re the right fit. NDA available before any technical discussion.