The missions a Keystone deputy can carry, shown as the kind of output your team would otherwise build by hand. Illustrative, but true to the shape of the real thing. ← Back to home
Built, with the story behind every number, ready before you’re asked, in language the room already speaks.
| Metric | Now | Target | Trend | Status |
|---|---|---|---|---|
| Critical assets patched ≤ 14 days | 62% | 85% | ▲ | Breach |
| Mean time to detect (hrs) | 9.4 | 4.0 | ▲ | Breach |
| Mean time to respond (hrs) | 26 | 24 | ▲ | Watch |
| Endpoints with EDR coverage | 94% | 98% | ▲ | Watch |
| Privileged accounts under PAM | 58% | 90% | ▬ | Breach |
| Backups restore-tested in period | 81% | 75% | ▲ | Met |
| Staff completing phishing training | 96% | 95% | ▲ | Met |
Centralized, hybrid or federated: the right way to execute for where you actually are, with a clear map of who runs what. So security gets delivered, not just designed.
| Function | Runs where |
|---|---|
| Governance & policy | Central |
| Detection & response | Managed + central |
| Identity & access | Central |
| Cloud security | Federated to platforms |
| Application security | Embedded in product |
| Third-party risk | Central |
| Metrics & reporting | Central · Keystone-run |
Every dollar of security spend mapped to the risk it buys down: tool overlap surfaced, licences right-sized, and a budget you can defend line by line.
| Finding | Action | Saving |
|---|---|---|
| 3 overlapping EDR / XDR tools | Consolidate | $180k |
| Shadow SaaS security tools | Bring in-contract | $165k |
| Legacy DLP, low usage | Decommission | $140k |
| Unused SIEM ingest tier | Right-size | $120k |
| Duplicate CSPM + CNAPP | Retire CSPM | $95k |
| Over-provisioned MFA seats | True-up | $60k |
Scored against NIST CSF and the SCF, with the gaps heat-mapped by business unit so budget goes where it moves the needle.
Collected once, kept current, reused across every framework you report to, so audit season is retrieval, not assembly.
| Control family | Frameworks | Evidence |
|---|---|---|
| Access control & review | 5 | Current |
| Change management | 5 | Current |
| Vulnerability management | 4 | Current |
| Encryption & key handling | 4 | Stale |
| Logging & monitoring | 4 | Current |
| Backup & restore testing | 3 | Stale |
| Supplier management | 3 | Missing |
Tiered, chased and assessed, and the concentration exposure no single vendor review will ever show you.
| Supplier | Tier | Position |
|---|---|---|
| Core payments processor | 1 | Concentration |
| Managed hosting provider | 1 | Overdue |
| Customer data platform | 1 | 4 findings |
| Payroll & HR SaaS | 1 | No exit plan |
| Contact centre outsourcer | 1 | Overdue |
| Marketing automation | 2 | Breach notice |
| Logistics integration | 2 | 4th-party |
Standing privilege reduced, orphaned accounts reconciled, leavers actually gone: the work that is always next quarter.
Assessed, remediated and re-assessed across every account and workload: the delta proven, not asserted.
| Finding | Sev | Status |
|---|---|---|
| Public storage buckets in Digital | Crit | Closed |
| Break-glass accounts without MFA | Crit | Closed |
| 0.0.0.0/0 ingress on 41 SGs | High | In flight |
| Logging disabled, 3 prod subs | High | Closed |
| Unencrypted snapshots (Payments) | High | In flight |
| Stale IAM keys > 365 days | Med | Backlog |
The two metrics your board actually asks for (mean time to detect and respond), produced, tracked and improved. We run the reporting so your SOC can run the response.
We don’t hand the finding back; we build and ship the control. Guardrails, automation and detections engineered into your stack, not added to your backlog.
| Control | Layer | Status |
|---|---|---|
| IaC guardrails: deny public storage | Cloud | Shipped |
| CI/CD secret scanning | Pipeline | Shipped |
| Privileged session recording | Identity | Shipped |
| Detection: impossible travel | SIEM | Shipped |
| Egress filtering baseline | Network | In build |
| Auto-revoke stale access keys | Identity | In build |
| Golden image hardening | Compute | Shipped |
Turn AI governance from a policy document into controls you can deploy, monitor and prove, across every model you build, buy and run.
Classify what the AI can see, decide and do. Assign a risk tier and record the decision.
Select the right controls across ten pillars, crosswalked to the major AI standards.
Turn each control into build-and-deploy code for your stack: IaC, policy, config.
Generate detections so security operations can see the controls actually holding.
Score real attack paths against your live controls. Mapped to OWASP LLM & MITRE ATLAS.
Rehearse the breach before you have one: unannounced, distributed, and written up as a board paper with named owners and dates.
| Gap identified | Owner | Due |
|---|---|---|
| No agreed threshold to take a platform offline | COO | 30 days |
| Regulator notification not pre-delegated | GC | 30 days |
| Holding statement not pre-drafted | Comms | 45 days |
| Out-of-band comms channel untested | CIO | 45 days |
| Cyber insurer notification path unknown | CFO | 60 days |
| No criteria to declare recovery complete | CIO | 60 days |
These are illustrative. The real ones start with a conversation about what’s on your desk.