Independence

What we will not do

Our assessments are worth reading because of what we have given up in order to make them.

We do not resell security products, hold reseller agreements, or take vendor commissions.

No vendor pays us anything, in any form, at any point. We hold no partner tier, no referral agreement and no revenue share. When a report recommends a control, the recommendation describes a capability the client needs — not a product line we are carrying. Where a specific technology is named, it is named because the assessment required it, and the reasoning is in the report for anyone to challenge.

We do not manage client infrastructure, because we could not assess it honestly if we did.

An assessor who also operates the environment is examining their own work. The findings that matter most — the ones about configuration, maintenance discipline and unclosed exceptions — are precisely the findings that would be about us. No amount of internal separation makes that report credible to a third party, and the client would be right to discount it. So we do not hold the keys. We look at the estate as an outsider, which is the only position from which the examination means anything.

We do not issue certifications, because the body that assesses cannot also be the body that advises.

Certification depends on a separation that we take seriously: an accredited certification body must not have advised on the system it certifies. We advise, we assess, and we prepare organisations to withstand certification audit — and then we step back and let an accredited body make its own independent judgement. Our work is worth more to a client precisely because it is not the thing that grants the certificate.

The cost

Why this matters more than it costs us

Each of the three is revenue deliberately foregone. Product margin, managed service annuity and certification fees are substantial businesses.

The problem is not that those businesses are illegitimate. The problem is what they do to the advice. Once a firm earns margin on a product, its assessments start to conclude you need that product. Once it manages your infrastructure, it stops finding problems with your infrastructure.

Nobody decides to become compromised. It happens gradually, through a hundred small commercial pressures — a quarter that needs closing, a renewal that must not be jeopardised, a finding that would be awkward to raise against a colleague — and the client is usually the last to notice.

We removed the pressure rather than promising to resist it.

Commission an assessment with nothing behind it

No product to sell you, no estate of ours to protect, no certificate of ours riding on the conclusion.

Contact