E3 methodology
Examine. Engineer. Execute.
Three phases, each with a deliverable of its own. It is designed so that you can review the result of every stage before authorizing the next, instead of taking a vendor at their word.
Why three phases
The most expensive mistake is made before you buy.
Most security projects start with the quote. Somebody asks three vendors for camera pricing, compares the numbers and picks one. The problem is that nobody defined what the system had to solve, so the three quotes price three different things and the comparison means nothing.
Separating the assessment from the sale changes the incentives. When the assessment is a deliverable of its own, you can take it to another vendor. That forces us to make it good.
The three phases
What happens in each one.
Examine — Understand before proposing.
A walkthrough of the site, a review of what is installed, interviews with the people who operate it, and a reading of the last year of incidents. We come out with the risk ranked by impact and likelihood, not by what can be sold.
If somebody proposes equipment before this phase, they are selling you a catalog.
DeliverableAn assessment with prioritized risks and the gaps in the current system
Engineer — Design the system, not the purchase.
Technical architecture, operating protocols, a definition of who decides what, and the business case. This is where it gets decided what will NOT be done, which is usually the most valuable part.
A project without a written protocol is a bill of materials on letterhead.
DeliverableEngineering drawings, protocols and a business case built on the site’s own figures
Execute — Install, operate and measure.
Installation, commissioning, training for the people who will use it, and operation against indicators. It is measured against the baseline from the assessment, so you can tell whether it worked.
Without a baseline there is no way to demonstrate improvement. And without that, renewal is an act of faith.
DeliverableA system running, as-built documentation and monthly indicators
What gets measured
Indicators that mean something.
A dashboard with a hundred charts is useless for deciding. These four are not, because each one has an owner and an action attached.
Response time
From alert to action
How long passes between the system detecting and somebody doing something. It is the indicator that separates guarding from documenting.
False alarms
Share of noise
If the operator gets a hundred useless alerts a day, they will ignore the one that matters. Bringing this down comes first.
Traceability
Events with evidence
What share of entries and incidents has video, a timestamp and a person responsible. That is what counts in a dispute.
Cost per point
Monthly operation
What it costs to cover one access point per month, all in. It lets you compare alternatives without arguing about camera prices.
What this method does not promise
It does not eliminate risk. It ranks it, reduces it where that is possible, and makes it visible where it is not. Anyone promising to eliminate it is selling you something else.
The first phase is not fast. A serious assessment takes days, not hours. If you are in a hurry we can start with a site visit and leave the full assessment for later, but it is worth knowing that is a shortcut.
It does not work without your people. The Execute phase includes training, because a system nobody knows how to use is back where it started in three months.
Frequently asked
About how we work.
Do I have to buy all three phases?
How long does each phase take?
Is the assessment charged separately?
Next step
Let us start with Examine.
An assessment is worth having even if you end up not hiring us for the execution.