Security Risk Assessments
A risk assessment that doesn't change what you do next wasn't worth doing. I've seen too many risk assessments that are really just a compliance artifact — a generic template filled out once a year, scored against a framework, filed away, and forgotten until the next audit cycle. A real risk assessment should tell you, specifically, what's most likely to hurt you and what to do about it in what order.
What makes an assessment useful
It starts with understanding what you actually have to protect and what it's actually worth — which systems and data matter most, what would really happen to the business if each one were compromised, and who or what realistically threatens them given your industry, your public footprint, and your past incidents. A risk assessment built on generic industry threat lists instead of your actual environment produces generic findings that don't help anyone make a real decision.
How I run one
I start by mapping your critical assets and data, then work through realistic threat scenarios against them — not an exhaustive catalog of every theoretical attack, but the ones that genuinely fit your environment and your attacker profile. For each meaningful risk, I look at likelihood and impact together, factoring in the controls you already have and being honest about whether those controls are actually working or just documented as working. The output isn't a heat map for its own sake; it's a prioritized list of what to fix first, with enough specificity that someone can actually act on it without a follow-up meeting to figure out what I meant.
Depending on what you need, this can map to a specific framework — NIST, ISO 27001, or whatever a customer or regulator expects — or it can be a standalone exercise focused purely on reducing your actual risk, independent of any compliance mapping. I'll tell you honestly which approach fits your situation rather than defaulting to whichever is easier for me to deliver.
Who this is for
Organizations that haven't had an honest look at their risk in years, companies about to make a major decision — an acquisition, a new product, a new market — that want to understand the security implications first, and anyone whose last risk assessment felt more like a formality than a real analysis.
If you want an honest picture of where you actually stand, get in touch.