Security Audits
A security audit should be uncomfortable in a useful way. If an audit comes back clean and everyone's relieved, I'd want to double-check whether it actually tested anything, or just confirmed that policies exist. The audits I run are built around one question: does this control actually work the way it's supposed to, under real conditions, or does it just look right on paper?
What I actually test
Documentation review is where most audits stop, and it's where mine starts. From there, I verify: pulling configuration exports instead of trusting a settings screenshot, checking actual access lists against who's supposed to have access instead of relying on an org chart that's a year out of date, sampling logs to see whether monitoring that's supposed to be happening is really happening, and testing whether an incident response plan would survive contact with an actual incident instead of just reading well. The gap between "documented" and "real" is where almost every finding that matters actually lives.
How I run an audit
I scope the audit around what matters most to you — a specific framework you need to demonstrate alignment with, a specific system or business unit, or a general health check of your whole security posture — and I'm upfront about what's in and out of scope before we start, because an audit that quietly expands or narrows mid-engagement produces results nobody can trust. During the audit, I go after evidence rather than assurances: configurations, logs, access records, and where it's useful, direct testing of whether a control holds up. At the end, you get findings that are specific and prioritized, not a generic severity-rated list that reads the same for every client I've ever had.
I also tell you plainly what's working well, because an audit that only ever finds problems starts to look less like an honest assessment and more like a sales pitch for more work. Sometimes the honest finding is that a control is solid and you can stop worrying about it.
Who this is for
Organizations that want an independent, outside look at their security posture, companies preparing for a customer or regulatory audit who want to find their own gaps first, and boards or executives who want assurance that's based on testing, not just a vendor's self-attestation.
If you want a real look, not a rubber stamp, reach out.