CYBERSECURITY
Two halves of one practice: offensive security and cyber defense.
Offensive security is the testing half: Continuous Offensive Security Testing (COST), Red Team and Purple Team. Cyber defense sees an attack, understands it and acts on it. Neither half is a component of the other.
Which question, which engagement.
| Your question | Start here |
|---|---|
| Is the program in control, and can we prove it? | The Security Assessment |
| Could a weakness be used against us? | Offensive Security |
| Would we see it, and would anyone act? | Cyber Defense |
- Smallest first step: a Platform Review, one platform, read only.
- Fixed scope entry point: the Security Assessment, Core or Full.
- Continuing ownership: the vulnerability program, or Advisory and vCISO, which sits over both halves as the accountable person and board reporting most rules require.
COST is one service inside offensive security.
A test that proves a weakness exists is not the test that proves your defense would have noticed it.
- Continuous Offensive Security Testing (COST). Recurring test cycles on an agreed cadence, each with a defined target set; a written test plan, agreed before any traffic, decides whether defenders are told. Findings carry evidence and reproduction steps.
- Red Team. An objective against the live environment, people and process included, defenders not told; you get the path, decision points marked.
- Purple Team. We run agreed techniques in the open while your defenders watch their own tools; both record whether each signal existed and reached anyone, and what would have carried it. Running the two separately costs two scoping cycles, two access grants and two reports to reconcile.
Cyber defense: seeing, understanding and acting.
Testing shows what can be done to you; cyber defense, whether a signal would follow and anyone would act.
- Cyber Defense
- Five scenarios from your environment, traced to the person who acts, clocks live in a tabletop.
- Cloud Security
- One platform, read only, no production change.
- Vulnerability Management
- Scanning on an agreed cycle, triage before ticketing, a stated ranking model, an owner per finding, a calendar approved before signing.
Every clock: the notification clock map.
We write what we observed and separately what we infer, and no report from this firm is represented as proof that an environment is secure or compliant. Test plans come first, in writing; every finding states its ranking basis. Partners says who hears partner findings first.
Three instruments create most of the demand.
| Instrument | Why it matters here | Who it reaches, and who it does not |
|---|---|---|
| FFIEC Information Technology Examination Handbook | Its work programs are public. | Reaches Banks, credit unions, technology service providers. Status Guidance, not a rule; scope scaled to size and complexity. Not It creates no independent legal obligation. |
| Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920 | Vendor oversight recurs in both halves. | Reaches Every bank the OCC, Federal Reserve and FDIC supervise, no asset size threshold. Status Guidance, not a rule. Not Credit unions; NCUA is not a party. |
| FTC Safeguards Rule, 16 CFR Part 314 | Annual penetration testing and semiannual vulnerability assessment, unless 16 CFR 314.6 removes them. | Reaches Nonbank financial institutions under FTC jurisdiction. Not Banks, savings associations, federally insured credit unions. Exempt Below 5,000 consumers whose information you maintain (not employees, loans or dollars), 314.6 lifts the written risk assessment (an unwritten one is still owed), testing cadence, written incident response plan and board report. The rest, 314.4(f) and FTC notice included, applies at any size. |
This firm builds the program and the evidence to the shape the instrument requires. Counsel confirms the legal reading for your state.
Vendor oversight already reaches your vendors' AI.
The interagency third party guidance reaches every third party of a supervised bank, with no asset size threshold or technology exception, so a vendor's new AI feature is covered. The same holds for a nonbank lender under 16 CFR 314.4(f), at any consumer count. That work, on the same evidence: the AI Vendor and Third Party Review.
When this work is done.
| Before | After |
|---|---|
| A test result nobody can explain to a board | Written for both readers, ranking basis stated |
| A vendor file that is a list | A documented review, decision and owner per relationship |
| Unchecked log coverage | Scenario by scenario, what is seen and which source carries the gap |
| Testing answered by whoever built the system | Answered by someone who did not |
Most of these engagements are decided by an assessment first.
Know which half? Say so. If not, the assessment decides.