Three steps before anything is signed

Why the order matters

Almost every wasted security budget we have been asked to review went wrong in the same way: the organisation bought the second step first. A penetration test was commissioned to satisfy an obligation that a penetration test does not satisfy, or monitoring was installed across an estate whose real exposure was one supplier with a standing remote connection. The tooling worked exactly as sold. It was answering a question nobody had established was the right one.

Consultancy establishes the question. Assessment answers it with evidence rather than opinion — how far someone gets, and whether anything noticed. Audit closes what the assessment found and produces the document a regulator, an insurer or a customer will accept. Each step is worth having on its own, and each one makes the next cheaper, because by then somebody has written down what actually matters.

What this is not

It is not a funnel that ends in a retainer. About half the organisations that take the first step turn out not to be in scope of the regime they were worried about, or to have bought most of what they need already and switched half of it off. We would rather write that down than sell a programme around it — partly because it is true, and partly because the ones we tell turn into the customers who come back with something real.

It is also not a fixed sequence you must enter at the top. An organisation that already knows its obligations and wants the attack path walked can start at the assessment; one that has a report from somebody else and needs the findings closed and certified can start at the audit. The order is a recommendation drawn from what usually goes wrong, not a contract.