Beyond compliance: building adaptive organisations¶
Regulatory checklists are useful only until the threat doing the breaking does something the checklist did not anticipate.
Attackers do not read ISO standards; they exploit human shortcuts, business incentives, and brittle processes. This workshop helps organisations move from checkbox compliance to genuine resilience — the kind that survives surprises and adapts as the world changes.
Core principles¶
Adaptive, not static: Maturity is a direction of travel, not a certificate on a wall. We design changes that can evolve.
Contextual, not copy-paste: Controls must fit your organisation’s mission, technology, and culture — not the other way round.
Forward-looking, not rear-view: We prioritise risks you are likely to face next, not the ones you faced last year.
Inclusive, not siloed: Resilience requires operational, legal, HR, product and leadership voices in the same room.
Evidence-driven: Recommendations come from interviews, observations, and light red-team probing — not from theory alone.
How it works: practical steps¶
This is a structured assessment and co-design process, scalable from a focused two-day review to a multi-week maturity programme.
Rapid maturity assessment (remote, 1–2 days)
Short survey and document review to establish the current baseline: policies, playbooks, incident history, and tooling.
High-level scoring across people, process, technology, and partnerships to focus next steps.
Culture and capability interviews (onsite or remote, 2–4 days)
Role-based interviews with leadership, operational teams, security, HR, legal, and key vendors.
Structured questions to reveal incentives, informal practices, knowledge gaps, and shadow dependencies.
Directed probing & light red team (1–3 days)
Non-destructive probing to test assumptions: phishing-lite, process walk-throughs, supplier failure scenarios, or a short red-team vignette.
The goal is to surface real-world gaps quickly, not to run a full adversary emulation campaign.
Co-design workshop (1 day)
Cross-functional session to translate findings into practical interventions.
Prioritise small, high-impact changes and define experiments to increase resilience rapidly.
Roadmap & playbook delivery
A pragmatic resilience roadmap with short-, medium-, and long-term actions.
A lightweight playbook capturing updated roles, simple metrics, and the first-wave experiments to run.
Typical outputs¶
A one-page resilience maturity snapshot with clear priorities.
A six- to twelve-week roadmap of pragmatic, tested interventions.
Role-specific short playbooks (operations, security, exec comms).
A short after-action report from probing exercises with recommended, timebound fixes.
Who this is for¶
Organisations that want resilience as an operational capability, not a compliance checkbox.
Executive teams who need concise, decision-relevant insight into organisational fragility.
Heads of security, risk or operations who must align technical controls with human and business realities.
Product, legal, and HR leads who want to understand how their policies actually play out in practice.
Formats & duration¶
Health check (2–5 days): rapid maturity assessment + executive briefing.
Deep review (2–3 weeks): full interviews, probing, and roadmap.
Programme (3 months): iterative implementation support, coaching, and follow-up probing.
Optional add-ons¶
Targeted red-team engagements (full emulation) for high-risk environments.
Playbook authoring and documentation handover.
Follow-up coaching sessions to embed changes and measure improvement.