Threat risk assessment
We turn a tangle of threats, assets and unknowns into a clear, scored picture your board and your engineers can both act on. Structured method, plain language, every finding traced back to its source.
Built on
What it is
Most security reports tell you what is broken. A proper assessment tells you what it means.
We start from the things you actually need to protect, work out who would come after them and how, then score the risk before and after the controls you already have.
What you get is a clear view of where your real exposure sits, ranked so you can put time and money where it changes the outcome. No scare tactics. No hundred-page export nobody reads.
The point of it
Once as it stands today, before anything is done about it. Again once the controls you have, or the ones we recommend, are accounted for.
The gap between the two is where an assessment earns its keep. It shows you what your existing investment already buys you, and exactly how much further a given fix would take you.
We assess the systems, data and processes that carry your real risk, not a generic inventory. Every finding traces back to something you value.
Threats modelled with STRIDE and mapped to MITRE ATT&CK, so the work reflects how attackers actually move against systems like yours.
Scoring you can put in front of a regulator, an auditor or a board. The same scale every time, every number traceable.
The method
Repeatable structure is what lets you compare a risk picture from one year to the next. Here is the path every assessment follows.
What matters, where it lives, what it is worth.
STRIDE and MITRE ATT&CK mapped to real attacker behaviour.
Weaknesses tied to each threat, not a scanner dump.
Likelihood times impact, scored before controls.
Mitigations matched to the tools you already run.
What is left, ranked, with a roadmap to close it.
Research
We publish full threat models and assessments anyone can read and cite. The method on display, sources named, nothing behind a form.
A reference threat model across the space, link, ground and user segments. Twenty-four named threats, eight actor classes, STRIDE mapping, a kill chain modelled on the 2022 Viasat incident and a defence-in-depth target state.
Read the threat model →Who it is for
An assessment earns its place the moment a decision carries weight. The report is written to be handed straight to the people who hold that decision.
Where to start
We will scope an assessment that answers it, on a timeline that fits, and tell you plainly what it will and will not cover.
Request an assessment →