Cybersecurity Case Studies: Work We Can Talk About

Because none of the three has given written permission, and permission is the only thing that would make naming them right. Security work runs under a non-disclosure agreement that does not lapse when the invoice is paid, and for testing engagements there is a second reason beyond the contract: a named case study tells a reader which company had which weakness, which is useful to more people than us. Where a client does agree, we name them and say so on the page, which is what the introduction above means by work we can talk about. Everything else stays anonymised: the sector, the scope, the approach and the numbers are exactly as delivered, and the identity is the only thing withheld. If that is not enough to judge us on, the scoping call is where to press.

Each figure counts something specific rather than something impressive. Audit exceptions are the exceptions recorded in the auditor's own report, so zero means the report carried none. Time to audit ready runs from the kickoff to the point the control set and evidence were complete enough for fieldwork, not to the certificate. Findings fixed and criticals closed are counted against the retest, so a finding only counts as closed when we retested it and it was gone. Mean time to fix measures from the day a finding was reported to the day its fix passed that retest, which makes it a measure of the client's engineering as much as ours. None of the three is a percentage of something unstated or a multiple with no baseline, which is the usual way a case study flatters itself. If a number matters to your decision, ask for the detail behind it on the scoping call and we will show you how it was arrived at.

Sometimes, and we will ask rather than promise. When a prospective client asks for a reference we go to the client whose work most resembles theirs and ask whether they are willing to take a call. Some agree and some do not, and we do not pass on a name before they have said yes. Where nobody is available we offer the next best thing instead of nothing: a walkthrough of the actual deliverable with the client's details removed, so you can see how findings are written, how severity is argued, and what a retest record looks like. Most buyers tell us the redacted report answers the question they were really asking, which is whether the work is any good rather than whether someone else liked us. It is also the fairer test, because a reference call reaches whoever was willing to take it, and a deliverable is the thing you will actually receive.

Only if you tell us in writing that it can, after the work is finished and you have read exactly what we propose to publish. The default is that nothing appears: no logo, no anonymised study, no quote. When we do ask, we ask once, we ask after closure rather than while you still need something from us, and a no changes nothing about the engagement. If you agree to an anonymised study, you approve the text, including which figures appear and how the sector is described, and you can ask us to take it down later without giving a reason. Our own reporting obligations, such as a regulator or an auditor asking who we work for, are handled through the engagement contract rather than through this page. The internal rule behind all of this is written down rather than remembered, so it survives whoever happens to be asking.