CYBER DEFENSE

Cyber defense: whether you would see it, and whether anyone would act.

Would the events that matter produce a signal, and would anyone act? Most answer the first in part, far fewer the second. The Detection and Response Readiness Review answers both.

Talk to our team The notification clock map

At a glance

Unit: Five named scenarios
You receive: Four artifacts, a tabletop
Retest: One round: closed backlog gaps rechecked against their scenarios

USE IT WHEN

Three situations this review answers.

Coverage is unknown. Nobody has mapped the scenarios that matter to the signals your tools would produce.
The response was never rehearsed. Nobody is named to declare an incident on a Friday evening, disconnect a system or call counsel.
A counterparty or examiner asked. How would you know? The honest answer is a list of products bought.

Four named artifacts, useful after the engagement.

Scenario Coverage RecordScenario by scenario, what would be seen and what would not, with the source carrying each gap.
Alert Fidelity NotesFor each existing alert, what it fires on, how often, and whether the person receiving it can tell a real one from noise.
Retention FindingHow far back you can actually look, source by source, against how far you would need to after an event.
Tuning BacklogAn ordered list separating what a configuration change fixes, what needs a log source you do not collect, and what needs a decision about ownership.

Then a two hour tabletop on one scenario. A tabletop tests whether a decision could be made, and by whom; a technical detection validation tests whether the signal exists. Neither substitutes for the other. Proof that a detection now fires is a Purple Team exercise.

HOW IT RUNS

One fixed scope, five scenarios from your environment.

Five named scenarios, agreed in writing beforehand, drawn from your environment and your obligations rather than from a generic list.
Each traced end to end: event, log source, retention, alert, who acts.
Alerts and retention reviewed. An alert nobody trusts is worse than none; retention is often shorter than policy.
The backlog ordered, so work starts the week after.
The tabletop run, recording what you knew, when, and which clock started.

Technology is described by category, never by vendor: endpoint telemetry, identity provider logs, email security, network telemetry, cloud control plane logs, the log platform. What you run is what gets reviewed.

We need read access to the log platform and alerting consoles in scope, your tabletop decision makers, including whoever calls counsel, and any managed provider's name, which changes who grants access and owns findings.

Access, and getting it back

We state in writing the access we need and why, at the lowest level that will answer the question.
You grant it, decide what it is scoped to, and can revoke it at any moment without asking us.
At closure we list in writing what to remove, item by item, and ask you to confirm it is removed.

The commitment in full is on Trust and Assurance.

One event, several clocks, not all starting together.

One event starts Ginnie Mae's clock at detection and a bank's at determination, days apart.

A bank's clock starts at determination, not detection: the distinction a tabletop rehearses. A credit union's starts earlier, at reasonable belief, so one procedure for both charters is wrong for one. Neither rule reaches the other charter, and neither has a size exemption.

The bank and credit union clocks, side by side
Who owes it	What starts it	The window
Banking organizations	Determination Determining that a notification incident has occurred, not detecting one	36 hours, to the primary federal regulator
Federally insured credit unions	Reasonable belief Reasonably believing a reportable cyber incident has been experienced	72 hours, to NCUA

Every row, and who each does not reach, on the notification clock map

Most institutions here run several; your charter and counterparties decide which. The review asks an examiner's questions, from the FFIEC IT Examination Handbook. NYDFS treats cybersecurity and AI as one subject (its AI letter), which is why we hold both practices.

This firm builds the program and the evidence to the shape the instrument requires. Counsel confirms the legal reading for your state.

What we do, and who does the rest.

We design and review detection and response. We do not operate a security operations center, monitor overnight or answer alerts. If you are in an incident now, the right call is to your insurer's breach counsel and the response provider on your policy, and we will say so rather than take the work.

We do the before and after: rehearsing decisions, rebuilding what an incident showed was missing. Coverage changes as systems and threats change.

With a managed provider

We measure the coverage they deliver against your scenarios, not the provider's own assessment, and help select one where monitoring is missing (referral policy). For any provider, panel firm or help desk sharing the response, we record:

The service boundary
Coverage and exclusions
Telemetry ownership
The escalation and acknowledgement path
Authority to act
The notification window
A missed service
Collisions between responders
The exit plan

Before you sign
Question	Answer
Proof of compliance	No. It gives an examiner or counterparty dated evidence to reach their own conclusion. No report from this firm is represented as proof that an environment is secure or compliant.
Your date	Tell us the date. The first reply, within one business day, says whether we can meet it.
Something urgent	We stop and tell you the same working day, by the escalation path and to the named person agreed in writing before the work began.
Retest	One round of verification of remediated findings is included in the fee as standard. Further rounds are quoted, and the proposal states the window.
If it stops	You keep everything produced to that point, in the form it is in that day.

Offensive Security tests whether a weakness could be used.

Bring five scenarios, or the ones you already argue about.

Unresolved incidents your team debates, or a counterparty raises, become the five. Tell us any examination date.

Fee: Fixed against this scope, in writing, in the first conversation, before you sign or grant access.
Duration: Elapsed time and your team's hours, in writing, with the fee.
A changed scope: Requoted, showing which change moved the number.
A number that proves wrong: You hear the day we know.

The commitment in full is on Trust and Assurance.

Talk to our team