Expertise
/
Threat, risk and vulnerability assessment
Threat, risk and vulnerability assessment
Method-led assessment that shows its working. What the credible threats are, where you are exposed, and which of those exposures is worth spending money on.
A matrix is a summary, not an assessment.
Most risk assessments arrive as a coloured grid. It gives you a number without telling you how the number was reached, which makes it impossible to challenge and equally impossible to defend.
The failure is usually one of provenance. A threat is asserted rather than sourced, a vulnerability is inferred from a walk-round rather than tested, and a likelihood is scored on instinct. None of that survives contact with a committee, an insurer or a regulator.
We write assessments the other way round. Source first, method stated, conclusion last. It takes longer to read and it holds up.
Four stages.
Named deliverables, not outcomes language
Threat assessment with sources cited and dated
Asset and exposure register mapped to your operations
Vulnerability findings, each with the evidence behind it
Treatment plan sequenced by cost and effect
Residual risk statement written for the person who has to sign it
Board or committee summary that does not require the full report to be read
A conclusion you cannot trace is a conclusion you cannot defend.
Who is this for?
Organisations with a board, an insurer or a regulator who will eventually ask how a decision was reached: local authorities, corporate estates, education, healthcare, and anyone preparing for a duty they will have to evidence.
Next step
Send us the brief
Every enquiry is read by the consultant who would do the work. No qualifying call with an account manager, no form that routes to a shared inbox.