Ciso Office
For the ciso office team that needs independent sources before an actual spending, legal or operating decision.
Review scope →Specialist divisions / Cyber Threat & Digital Risk Intelligence
Specialist evidence services
Cyber Threat & Digital Risk Intelligence
What publicly reported incident facts are corroborated and material?
Who commissions this work
Cyber Insurers
For the cyber insurers team that needs independent sources before an actual spending, legal or operating decision.
Review scope →Incident Counsel
For the incident counsel team that needs independent sources before an actual spending, legal or operating decision.
Review scope →The real purchase trigger
Reported breach, third-party incident, vendor assurance claim
Correlate vendor notices, regulatory disclosures and independent chronology without system access.
We make the client’s claim, the original record, conflicting sources and the unknowns readable before commitment.
Choose one of eight defined services
Cyber External Evidence Brief
One named subject or event; up to three material claims; agreed source jurisdictions and date window. Deliverable: Source coverage sheet, first three contradictions or gaps, clear next-record requests.
Review service and acceptance →Identity decision · Identity & Source Map
One main entity or asset and up to four related names, owners, locations, records or aliases. Deliverable: Entity or asset-resolution table, link-confidence explanation and original source chain.
Review service and acceptance →Claim decision · Material Claims Verification
Up to five numbered claims from a supplied proposal, transaction pack or public statement. Deliverable: Claim-by-claim citations, opposite sources, date-sensitive uncertainty and unproved statements.
Review service and acceptance →Timing decision · Independent Chronology Reconstruction
One bounded event sequence; disclosed evidence window; source provenance and known omissions. Deliverable: Chronology chart, disputed-event table, original-record references and unresolved sequence.
Review service and acceptance →Counterparty decision · Counterparty & Relationship Check
Named entity and up to five related organisations or responsible entities identified from lawful records. Deliverable: Evidence-supported relationship diagram, mismatches, ownership questions and exposure caveats.
Review service and acceptance →Decision-pack review · Decision-Ready Evidence Dossier
One defined commercial decision, six critical questions, specified sources and no unlimited investigation. Deliverable: Executive decision memo, evidence/contradiction matrix, dated primary-source index and recommendations for further questions.
Review service and acceptance →Repeat-work pilot · Repeat-File Evidence Desk
Written pilot of up to ten defined file types, with sampling rules, turnaround assumptions and exclusions. Deliverable: Consistent file-by-file evidence cards, exception register and consolidated management view.
Review service and acceptance →Cyber Incident & Vendor Risk Watch
One named subject or a written small watchlist; specified public records, cadence, escalation threshold. Deliverable: Dated change log, evidence citations, false-positive dispositions and monthly change summary.
Review service and acceptance →Eight focused specialist pathways
Each pathway has a narrower research question, decision-ready evidence specification, source scope and written-commissioning path.
Cyber Threat Landscape Intelligence
Test the exact source and contrary evidence behind cyber threat landscape intelligence, rather than commission a generic industry report.
Review scope →Third-Party Cyber Risk Research
Test the exact source and contrary evidence behind third-party cyber risk research, rather than commission a generic industry report.
Review scope →Cyber Incident Chronology Research
Test the exact source and contrary evidence behind cyber incident chronology research, rather than commission a generic industry report.
Review scope →Ransomware Incident Intelligence
Test the exact source and contrary evidence behind ransomware incident intelligence, rather than commission a generic industry report.
Review scope →Cybersecurity Vendor Reality Checks
Test the exact source and contrary evidence behind cybersecurity vendor reality checks, rather than commission a generic industry report.
Review scope →Digital Exposure Research
Test the exact source and contrary evidence behind digital exposure research, rather than commission a generic industry report.
Review scope →Cyber Regulatory Monitoring
Test the exact source and contrary evidence behind cyber regulatory monitoring, rather than commission a generic industry report.
Review scope →Cyber Reputation & Breach Intelligence
Test the exact source and contrary evidence behind cyber reputation & breach intelligence, rather than commission a generic industry report.
Review scope →Research sources to test
The following sources may support this type of work; their existence is not a claim that a prospective client or named matter has been verified.
NIST AI risk management framework
Source to test against the actual claim, checked for effective dates, coverage and access limitations. Not a client-specific verification result.
Open source →Kroll investigations & diligence services
Source to test against the actual claim, checked for effective dates, coverage and access limitations. Not a client-specific verification result.
Open source →Evidence deliverables and professional limits
What the decision owner receives
- Cyber External Evidence Brief
- incident chronology
- statement delta log
- third-party risk evidence brief
- Source-linked claim analysis
- Dated assumptions, contradictions and missing evidence
What remains outside the mandate
No intrusion, hacking, private forensics or unauthorized scanning.
Acceptance is conditional on conflict, jurisdiction, lawful access, data protection, capacity and written fee approval.
Start with the decision, not a large retainer
Buyer stages
Match the size of the assignment to the present decision.
Review scope →Example evidence pack
View the contents of an illustrative research output without invented findings.
Review scope →Fees & engagement
Understand written standard-fee proposals, pilot limits and the approval process.
Review scope →Evidence questions worth resolving
Decision questions
- Which public records establish incident disclosure and dates?
- Does a CVE/KEV entry actually establish this supplier was exploited?
- What is documented remediation evidence versus a self-asserted statement?
Contrary-evidence tests
Division evidence guide (PDF)
Change-monitoring method (PDF)Lawful-source coverage varies. The documents explain the proposed method; no case, professional certification, continuous watch or fee has been approved automatically.