Consulting

The desk establishes what the problem is, states it in writing, and says what fixes it. Usually that is an engagement we run ourselves. Sometimes it is Cerebro, Crimson Academy, or a product.

Talk to a consultant → How an engagement runs

How an engagement starts

Most consulting starts with a statement of work written by the client before anyone has looked. Ours starts with a look. The scope comes after the diagnosis, which is the only order that produces a scope worth paying for.

You

Tell us what's keeping you up

An incident you can't explain, an audit you can't pass, a datacenter nobody is watching, a board asking questions you can't answer yet. Plain language. No RFP required.

Diagnose it, in writing

A short scoping conversation, then a written read on what the problem is, what it isn't, and what it would take to fix. If the answer is a product, we name it and say why.

Then

Route it or run it

Offensive work goes to Cerebro. Training goes to Crimson Academy. Everything else is scoped as an engagement with a fixed deliverable, or we tell you that you don't need one.

No retainers to start. The first conversation is a diagnosis. Start the conversation →

What the desk takes on

Everything below is delivered by people who spent their careers on the offensive side of national-security networks. That background is the product: it changes what gets found, what gets ranked first, and what gets dismissed as noise.

Architecture & exposureWhere the estate is exposed, ranked by how an operator would use it. Identity paths, control planes, trust boundaries, and the systems nobody owns.

Detection & visibilityWhat you can see, what you cannot, and the cheapest order to close the gaps. Sometimes a product. Sometimes a config change and a conversation with your SIEM vendor.

Incident readinessPlaybooks, evidence handling, escalation paths, and the decisions you will have to make at 3 a.m., rehearsed in advance.

Threat modelingApplied to new systems during design. How an adversary would approach the architecture, and what to change while changing it is still cheap.

Vendor scrutinyWhat a security product does against what its deck claims, tested the way an attacker would test it. This includes products we refer clients to.

Board advisoryRisk, spend and vendor decisions for leaders who need an answer rather than a 90-page assessment. Standing or one-time.

Where it lands

When the honest answer is one of our own services or a partner's product, we say so early and in writing, along with the alternatives.

Hypervisors and control planes nobody is watchingReferred to TensorOne, an independent partner→ TensorOne

Penetration testing, adversary emulation, intel sharingOffensive work and the hunts that come out of it→ Cerebro

Workforce fundamentals and early-career trainingLinux, Windows, networking, security essentials→ Crimson Academy

Everything elseScoped engagement with a fixed deliverable, or a recommendation to go elsewhere→ Consulting

Get in touch

One conversation. You'll leave it knowing what the problem is, what it would take, and whether we're the right people to do it.

Talk to a consultant → Email info@pencrimson.com