Where the impact lands
We start from business impact and work back to the systems that concentrate it, rather than assessing everything evenly.
Know which security risks to address first.
An assessment across systems, vendors, people, and controls that ends in one ranked list of where risk concentrates and what to fix first.
Assessment scope
What we assess
We rank risks by impact, likelihood, and the strength of existing controls, then assign remediation priorities and owners.
What is holding
We assess the evidence that prevention, detection, response, and recovery controls work in practice.
Who owns the decision
We establish where security decisions get made, who is accountable, and what evidence exists when someone asks.
What you can realistically fix
We size remediation against the team and the time you actually have, so the sequence survives contact with the roadmap.
Timing
Best used when you need to know what to fix first.
When leadership needs clarity
Leadership needs a clear account of the risks, priorities, and owners.
Before an external assessment
A regulator, auditor, insurer, investor, or customer needs evidence of how risks are managed.
When priorities are unclear
The program has many findings but no clear sequence.
When your risk profile changes
A new product or program changes the organization's exposure.
Our approach
How we turn risk evidence into priorities.
Define the decision and gather evidence
Agree the leadership, investment, or remediation decision. Review architecture, controls, and incident history, and record gaps in the available evidence.
Map where risk accumulates
Trace failure scenarios across systems and teams. Assess likelihood, impact, and control strength to show where exposure is concentrated.
Rank actions and assign owners
Prioritize decisions and remediation based on the evidence and the team’s capacity. Agree owners and explain the order of work.
Prepare the executive readout
Summarize the material risks, evidence gaps, and recommended sequence of decisions so leadership can act on the assessment.
What you receive
One ranked list your leadership can act on.
Risk concentration map
Where material exposure accumulates across the organization.
Prioritized decisions
One ranked list, with an owner against each item and an order we can defend.
Executive readout
A concise view of material risk and sequencing.
Your engagement team
Meet the specialists
A principal leads each engagement. Your proposal names the specialists assigned to the scope.
Piotr Cielas
Principal Advisor
Head of Security at Agora, responsible for security, data protection, and corporate IT risk. Earlier at EY, led assessments across financial services, healthcare, and government.
Paul Vijender
Specialist Advisor
Head of Security at Gauntlet, with experience in product security, IAM, cloud, DevSecOps, and blockchain. Previously held security roles at Tensor, EY, Broadcom, and ADP.
Timur Güvenkaya
Founder & Partner
Led a security engineering practice for Rust and non-EVM systems across Substrate and NEAR. Earlier, built vulnerability-detection engines at Invicti used by Fortune 50 and public-sector organizations.
FAQ
Frequently asked questions
How is this different from a penetration test?
A penetration test validates attack paths in a system. A risk assessment examines evidence across systems, vendors, people, and controls to prioritize what to address.
Do you need to scan or test our systems?
Not usually. The assessment runs on architecture, controls, evidence, and interviews with the people who operate the systems. Where a claim cannot be substantiated any other way, we say so rather than assume it holds.
We already have a list of findings. Why do this?
We help rank the findings, assign owners, and sequence remediation against your team’s capacity and business priorities.
Who is the output written for?
Leadership, boards, regulators, auditors, insurers, and institutional customers. It is written to be read by someone who is not an engineer, with the technical detail kept underneath rather than removed.
Can you use our existing audits and assessments?
Yes. Existing reports, remediation records, incident reviews, and control evidence can inform the assessment. We check what they cover, whether the system has changed, and where evidence is still missing.
What happens if the evidence is incomplete?
We identify the gaps and explain which conclusions they limit. Where a decision depends on an unverified control or assumption, we state what further evidence or testing is needed.
Related services
Other ways we can help
Secure Architecture & Process Design
Design or assess critical systems, workflows, integrations, and operating controls before implementation or a major change.
Explore 
Penetration Testing
Test the attack paths that connect web, mobile, APIs, cloud, identity, and infrastructure.
Explore 
Digital Asset Program Advisory
Make security, custody, vendor, and operating-model decisions across a broader digital asset program.
ExploreMake the next security decision clearer.
Describe your main concerns, the decision you need to make, and who needs the results. We will define the assessment scope.
Discuss your scope