Consulting
Assess the risk before buying anything.
Most security projects start by asking for three quotes. The problem is that nobody defined what the system had to solve, so the three quote three different things and comparing them tells you nothing.
Why it is separate from the sale
An assessment you cannot take elsewhere is not an assessment.
We deliver the assessment as a document of its own, detailed enough for you to execute it with whoever you choose. That sounds against our interest and it is deliberate: when the assessment has to stand on its own, it forces us to make it good.
It also changes the conversation. A vendor who both diagnoses and sells has an obvious conflict: they always find that what is missing is exactly what they sell.
See the E3 methodDeliverables
Four documents, depending on scope.
Risk assessment
A walkthrough, interviews and an incident review, with the risks ranked by impact and likelihood. It is the document that lets you decide where to spend first.
Master security plan
The 12 or 24-month plan: what happens in each stage, on what budget and in what order. It turns a list of pending items into a program.
Technical architecture
What equipment, where, to what specification and why. It lets you tender to three vendors comparing the same thing instead of three different ones.
Business case
What the current arrangement costs against what the proposed one would cost, using figures from your own operation. It is the part you need in order to get it approved.
When it is worth it
Three situations where the assessment pays for itself.
- You already invested and incidents continue. That is a sign the problem is design or protocol, and neither of those is something you buy: they get assessed.
- You are going to tender and want to compare like with like. With a technical architecture in hand, all three proposals quote the same thing and the price finally means something.
- You need approval from a board or a committee. The business case, built on your own figures, is what turns a budget request into a decision.
Honest about the scope
We are not a law firm. We flag the data protection obligations your case triggers — above all where there is biometrics or license plate reading — but the privacy notice and the contracts are drafted by a lawyer.
We do not audit cybersecurity. Our field is physical and operational security. Where the two touch — cameras on the corporate network, for instance — we flag it and recommend who to take it to.
Frequently asked
About the consulting work.
What does a risk assessment cost?
How long does it take?
Can I buy only the assessment?
Is the site visit the same thing?
Next step
Let us start by understanding the risk.
A thirty-minute conversation is enough to tell whether your case needs a full assessment or is solved with a site visit.