How I work
What you’re paying for,
and where it stops.
Every engagement below is bespoke, so this is not a process diagram anyone gets marched through. It is how I think about the work, and — more usefully — where I stop.
What you’re actually paying for
Not a methodology. Pattern recognition you can only build by being wrong under pressure and surviving it — learned in a few specific rooms: examiners across the table from a $700B bank’s security program, the working group drawing the lines on what could and could not cross a national border during a $69B acquisition, federal analysts on a data problem that should never have left American servers.
Those rooms do not hand you a checklist. They hand you a problem with consequences attached, and you find out quickly whether what you thought you knew survives contact with the actual thing. A good deal of the job is telling a chief executive that what his last vendor sold him is not security — it is compliance theater with a bigger invoice.
How I do it
Four steps, in this order, at whatever depth the engagement calls for.
-
1
Assess current state
Where are we, honestly. Not where the last assessment said we were, and not where the org would prefer to be seen.
-
2
Define desired state
Where do we want to go, stated concretely enough that you can tell whether you have arrived.
-
3
Develop the plan
How we get there, sequenced by what actually blocks you rather than by what is tidiest on a slide.
-
4
Execute
Usually yours. In an advisory capacity I can do the first three; execution belongs to your team unless the engagement is large enough to buy mine. Both are honest answers, and which one you need is normally clear inside thirty minutes.
Where the scope stops
I am not a managed service. Nobody here is watching your alerts overnight. If monitoring is what you need, you will be told that on the first call rather than sold something adjacent to it.
I do not staff-augment. An engagement is judgment or ownership, not a body added to your headcount to work someone else’s backlog.
I do not issue certificates. No engagement here ends in a badge, an attestation, or a letter you can wave at a regulator. It ends in a defensible position and the evidence behind it.
I will not sell you the expensive version. If the cheapest thing on the list solves your problem, that is the recommendation — even when it is the one I am not being paid for.
Engagements are designed to end. For an operating role, hiring my own replacement is part of the job. A dependency is not a deliverable.