Home / Services / Security Program

Security Program

Not sure where to start? We assess what you have, identify the gaps, and build a realistic plan with your team.

Get a quote Book a 30-min call
Overview

Know where you stand.

We benchmark you against NIST CSF and CIS Controls, map your external footprint the way an attacker would, and run a formal risk assessment aligned to ISO 27005. You leave with a plan your team can start on Monday — and an executive-ready presentation to secure the budget.

Deliverables

What you get.

A complete, evidence-based view of your security posture and a plan to improve it.

01
Maturity Assessment

Benchmarking against NIST CSF and CIS Controls to show exactly where you stand, function by function.

Learn more →
02
Attack Surface Assessment

Discovery of your external footprint — domains, exposed services, and assets — the way an attacker sees you.

Learn more →
03
Risk Assessment

A formal risk assessment aligned to ISO 27005, with a clear register and treatment options.

Learn more →
04
Roadmap & Prioritisation

A sequenced roadmap with effort, impact, and cost attached, so investment goes where it reduces the most risk.

05
Executive Presentation

A board-ready presentation that translates findings into risk and business terms to secure buy-in and budget.

06
Program Build-Out

Hands-on support to execute the roadmap — on your team or via our managed security service.

Learn more →
Aligned to: NIST CSF CIS Controls ISO 27005 ISO 27001
How we work

Our engagement process

Every engagement follows the same five phases — scoped clearly, with no surprises in delivery.

Phase 01
Scoping

Objectives, frameworks, and scope agreed in writing before any work begins.

Phase 02
Evaluation

Assess maturity, map the attack surface, and identify and rate your risks.

Phase 03
Implementation

Build the prioritised roadmap with effort, impact, and cost for each initiative.

Phase 04
Reporting

Detailed findings plus an executive presentation ready for the board.

Phase 05
Finalising

Debrief and optional support to begin executing the roadmap.

FAQ

Security program FAQ

Common questions about scope, cost, and timing.

What is a security program engagement?
A strategic assessment of your security posture — maturity benchmarking, attack-surface mapping, and risk assessment — turned into a prioritised, costed roadmap your team can act on.
How much does it cost?
A maturity or attack-surface assessment is typically €2,000–5,000, and a formal ISO 27005 risk assessment €3,000–6,000. Use our estimator for a tailored figure.
What assessments do you offer?
Security maturity assessment (NIST CSF / CIS Controls), attack surface assessment, and information-security risk assessment aligned to ISO 27005.
How long does it take?
Most assessments take 1–2 weeks; a formal risk assessment takes 2–4 weeks, including a board-ready report.
What is the difference between a maturity and a risk assessment?
A maturity assessment scores your capabilities against a framework; a risk assessment evaluates specific risks to your assets. Many organisations do both.
Do you provide a roadmap and executive presentation?
Yes — every engagement produces a prioritised roadmap and a board-ready presentation to secure buy-in and budget.
More questions about this service
Is this a good first engagement?
Yes — it gives you an honest baseline and a costed plan before you invest in tooling or certification.
Can you help execute the roadmap?
Yes — through our managed security, compliance, and vCISO services we help deliver the plan, not just write it.

Build your roadmap.

A 30-minute scoping call costs nothing. Spending blind costs considerably more.

Book a short call Send an email