Your security organisation and your controls: who decides, who owns what, and which controls are running.
The binding constraint is rarely a missing product. It is that nobody owns a decision, or the team that would fix something never hears about it, or a control was bought and never finished being deployed. Those are properties of an organisation, not of a control set, so the review covers both together and says where your next unit of effort goes furthest.
Each row is one dimension on a four-step scale. The filled block is where the organisation sits today and the dashed one is the target agreed with it, so the gap between them is the plan.
Assessed bottom-up, by testing
Assessed top-down, by documentation and interview
Illustrative positions. Filled is today, dashed is the agreed target.
Eight dimensions, four of them organisational and four technical. Four are assessed top-down, by reading the documentation and interviewing the people who own the work, and four bottom-up, by testing: internet and internal exposure scans, an IAM review, endpoint and server baseline checks. The comparison is against security practice in comparable organisations rather than against a checklist standard. The output is a rating on each of the eight, and a split between what can be fixed in weeks and what is a year of work. Those are different conversations with different budgets, so they are reported separately.
Our Hackability Score puts organisations on a single scale from an Internet survey alone, which makes comparison across industries and regions possible. It reads four things an outsider can see: identity and access management, security architecture, asset hardening and patch management. We built it by scanning more than 5,000 companies across geographies and verticals. In that data, from 2018, banks came out among the three best-protected industries. The score reads only what is visible from the Internet. It says nothing about endpoint security and nothing about whether anyone inside those banks would click a link, and we have not re-run it since.
How
Internet-wide scanning across four directly measurable areas, scored per organisation and aggregated by industry and region.
What it does not support
It reads only what is visible from the Internet. It says nothing about endpoint security and nothing about social-engineering resilience, and it has not been re-run since 2018.
The Hackability of organizations can be measured and comparedBanks scored above other industries, but not evenly across the sub-scores: the areas an auditor looks at were ahead, and the areas an auditor does not were behind. Regulation moved attention, not security.
How
Compared the shape of the Hackability sub-score distribution for banks against other industries, testing two competing explanations: security evolution under attack pressure, versus compliance-directed effort.
Banking regulation has an effect on HackabilityWe assess your technical controls and your security organisation against your actual threat profile.
The subset of findings that can be closed in weeks, separated out so they actually get done.
The structural changes, planned properly, with the sequencing that makes them survive.
Four are assessed top-down, by documentation and interview. Four are assessed bottom-up, by testing.
How the organisation runs
How the technology holds
We interview the people doing the work as well as the people accountable for it, and the gap between the two accounts is usually where the finding is. The technical half is measured, not asked about: internet and internal exposure scans, an IAM review, endpoint and server baseline checks, the same reading that produced the Hackability data across more than 5,000 companies. What is deployed matters more than what was purchased, so the technical checks read running configuration. A recommendation that needs a reorganisation before anyone can adopt it is worth little. We write the report so the person who has to act on each item can find their own part without reading all of it.
Tell us what you are building and what you need looked at. You will get an answer from the people who would run the engagement, and if another firm is the better fit for what you are asking, we will name one.
Security Research Labs is a member of the Allurity family. Learn more(opens in a new tab)