Services
Executive cyber counsel, grounded in how plants actually run.
Three engagement models and one consistent toolkit, all built to reduce cyber risk without disrupting production.
Flagship · Retainer
Executive Cyber Risk Advisory
A standing partner relationship for leaders who need a trusted cyber voice at the table. We sit alongside the executive team and board, turn technical findings into business decisions, and keep the roadmap honest as the business changes.
Best for: Manufacturers without a full-time CISO, or a CISO who wants a senior, independent advisor in the room.
What you get
- Board- and committee-ready cyber risk reporting
- OT-aware prioritization tied to uptime, safety and revenue
- Incident readiness program with clear decision rights
- Strategic security roadmap and investment guidance
- Independent review of vendor and integrator proposals
- Direct access to a partner when new issues surface
Fixed scope
Manufacturing Cyber Risk Posture Assessment
An executive-level evaluation of where cyber risk meets operations: what is exposed, what it would cost in uptime and safety, and where governance has gaps.
Best for: A first baseline, a new plant or acquisition, or a board asking “how exposed are we, really?”
What you get
- IT/OT exposure review across plants and the enterprise
- Uptime and safety impact analysis for critical lines and processes
- Weighted 0–100 risk scoring of technical findings
- Governance, ownership and control maturity gap analysis
- Prioritized 90-day and 12-month roadmap
- Executive readout and board-ready summary
Readiness & live support
Incident Readiness & Response Advisory
Preparation for the worst day, and a steady senior hand when it arrives. We focus on the decisions only leadership can make.
Best for: Teams that have never rehearsed a cyber event at the leadership level, or that just lived through one.
What you get
- Executive tabletop exercises built on realistic OT scenarios
- Decision frameworks: who stops a line, who calls the insurer, who speaks to customers
- Incident response plan review against how your sites actually operate
- Leadership support during live cyber events
- Post-incident review and board communication
Assessment toolkit
Instrumented, repeatable methods.
Every engagement draws on the same scoring models and ID-coded instruments, so results stay comparable across sites, interviewers and years.
Vulnerability Risk Scoreboard
Environment-wide scan results scored per host on a weighted 0–100 Cyber Risk Score and tiered Low, Moderate, High or Critical. Repeated findings are grouped so one baseline fix can close dozens of tickets.
SOC 2 Control Maturity Review
63 ID-coded interview questions across the 11 Trust Services criteria, each scored 0–4 on verifiable practice, plus 8 binary red-flag checks.
AI Risk Maturity Assessment
73 questions across 12 AI risk domains, including governance, data, security, transparency, human oversight and third-party AI vendors, plus 7 red-flag checks.
Executive Risk Scorecard
Every result in one interactive scorecard: headline ratings, priority remediation, and the methodology behind each number, ready to revisit as fixes land.
Insurance & audit readiness
Evidence and control narratives that answer underwriter, auditor and customer security questionnaires accurately, without over-promising.
Scoring formula: Cyber Risk Score = min(100, 10×Critical + 5×High + 2×Medium + 1×Low). Informational findings are tracked but never scored.
How an engagement runs
From first call to first move.
- Confidential conversation 30 minutes with a partner. NDA available up front.
- Scoping Sites, systems and stakeholders agreed, then a fixed-scope proposal.
- Assess Scans, interviews and site walk-throughs, scheduled around production.
- Translate Scoring and prioritization in terms of uptime, safety and revenue.
- Brief Executive readout and a board-ready summary with a clear first move.
- Stay close Optional retainer advisory to keep the roadmap moving.
Common questions
Will your assessment disrupt production?
No. Active scanning of OT networks is scoped with your operations team. Where active scanning isn’t safe, we rely on passive data, configuration review and interviews. Plant schedules come first.
Do you sell or implement security products?
We’re vendor-neutral. We help you evaluate vendors and hold integrators accountable, but our recommendations aren’t tied to any product.
Who actually does the work?
Partners. The person you meet in the first conversation leads the engagement.
How do you handle our information?
Under NDA, on a need-to-know basis, with findings exchanged through secure channels. We never publish client names without written permission.
Talk to a partner, not a sales team.
A 30-minute confidential conversation to understand what’s at stake and whether we’re the right fit. NDA available before any technical discussion.