Cybersecurity advisory focused on improving security operations, cybersecurity program assessments, incident readiness, and managed security delivery quality.
01 / Perspective
Modern security operations increasingly have two actors: people and AI. Process governs how their work is performed, while technology enables it.
This is an operating lens, not an implementation sequence. AI and traditional automation are evaluated separately because they play different roles and introduce different control needs. Measurement and outcomes span all four dimensions.
Measured by outcomes.02 / Services
Our work focuses on four areas: how cybersecurity programs are directed, how security operations perform, how organizations prepare for incidents, and how managed security services are delivered.
Assess and improve how security operations perform across people, AI, process, and technology.
Security Operations Assessment & Roadmap
Operating model, workforce, detection, alert lifecycle, investigation, escalation, AI, automation, technology, quality, and measurement.
View Details →Establish a broad, risk-informed view of cybersecurity governance, capabilities, gaps, dependencies, and priorities.
Cybersecurity Program Assessment & Roadmap
Program-level review aligned primarily to NIST CSF 2.0, including the governance and cyber-risk implications of AI.
View Details →Improve preparedness, decision-making, escalation, communications, technical readiness, and recovery before an incident.
Readiness Assessment · Tabletop Exercise · Combined Readiness + Tabletop
Practical preparation and facilitated learning, not emergency response execution.
View Details →Provider-side advisory for organizations delivering managed security services at scale.
Managed Security Operations & Service Delivery Assessment
Multi-client operations, service delivery, workforce, quality, customer experience, AI, automation, scalability, and efficiency.
View Details →03 / Service Detail
Explore how each service can be tailored to your organization's needs.
A deep assessment of how the security operation functions across People, AI, Process, and Technology. We examine whether the organization can consistently detect, investigate, escalate, and respond to threats while operating efficiently and producing measurable outcomes.
This is an operating assessment, not simply a review of the technology stack. Tools matter, but only in the context of the people, decisions, workflows, controls, and measurements they enable.
Organizational structure, ownership, decision rights, tier and role design, operating cadence, and governance.
Staffing, capacity, shifts, 24x7 or after-hours coverage, skills distribution, management span, handoffs, and on-call expectations.
Detection strategy, telemetry alignment, content ownership and lifecycle, tuning, testing, and recurring false-positive or low-value alert patterns.
Intake, enrichment, assignment, investigation workflow, case quality, disposition, and analyst consistency.
Severity, escalation thresholds, notification, handoffs, incident declaration, and coordination.
Analyst augmentation, assisted triage and investigation, vendor-native AI, agentic workflows, human approval, data boundaries, auditability, failure modes, quality, and demonstrable value.
SOAR, deterministic workflows, orchestration, repetitive analyst tasks, automation opportunities, and failure points. AI and automation are evaluated separately.
SIEM, EDR or XDR, case management, telemetry, integrations, usability, and workflow fit.
QA, SLA and KPI design, backlog and aging, investigation quality, operational and executive reporting, and continuous improvement.
Where applicable, responsibility split, coverage, alert routing, escalation, detection ownership, handoffs, shared tooling, and performance.
When the problem is already understood, the engagement can be narrowed to a defined operating challenge. Examples include:
Focused reviews are available when the operating challenge is already known.
Our broadest organizational assessment evaluates whether the cybersecurity program is appropriately managing material risk and where leadership should focus next. It is broader than the Security Operations Assessment, while intentionally providing less depth inside each individual technical domain.
The assessment is organized primarily around NIST Cybersecurity Framework 2.0:
Ownership, accountability, strategy, policy, risk governance, third-party governance, and executive reporting.
Assets, critical systems, data, business dependencies, and the organization’s understanding of cyber risk.
Identity and access, endpoint security, vulnerability and exposure management, data protection, awareness, and core preventive controls.
Logging, monitoring, detection capability, and managed-provider coverage.
Incident readiness, escalation, communication, coordination, and decision authority.
Backups, restoration, resilience, dependencies, and recovery planning.
A cross-cutting review of sanctioned and shadow AI, acceptable use, sensitive-data exposure, AI vendor risk, AI-enabled SaaS, agents and machine identities, security involvement in adoption, AI-enabled threats, and defensive AI use.
Broad assessments identify. Domain assessments investigate. Focused reviews diagnose deeply.
This is a program-level, risk-informed assessment using interviews, documentation, representative evidence, and targeted validation. It is not automatically an exhaustive technical audit, penetration test, source-code review, full cloud configuration or identity architecture assessment, compliance certification, or audit opinion.
If a material issue is identified, we may recommend a deeper review or support from a qualified specialist.
When deeper analysis is needed, reviews can focus on the specific area or decision at hand.
Incident Response Readiness prepares the organization before a serious cyber incident. We help leadership and technical teams clarify roles, improve decision-making, test assumptions, and identify gaps before they are forced to do so under pressure.
Plans and playbooks, stakeholder responsibilities, severity, escalation thresholds, incident declaration, and executive decision rights.
Internal and external communications, legal, insurance and vendor coordination points, emergency contacts, and cross-functional handoffs.
Detection and escalation inputs, evidence considerations, access, tooling, technical coordination, and operational dependencies.
Recovery dependencies, restoration decisions, exercise observations, after-action review, and improvement ownership.
Depending on the agreed scope, outputs can include:
This service focuses on preparedness and advisory. It does not include breach counsel, DFIR, forensic acquisition, malware analysis, ransomware negotiation, or 24x7 emergency response.
Organizations delivering managed security services face operating challenges that an internal SOC assessment does not fully capture: multiple clients, service tiers, variable workloads, contractual SLAs, customer communications, multi-tenant technology, quality consistency, onboarding, and the need to scale without degrading outcomes.
We evaluate the operation as both a security function and a repeatable managed service. We work with MSSPs, MDR providers, managed SOC providers, and other organizations delivering managed security services.
This service is designed for organizations delivering managed security services. Organizations evaluating an external provider can instead engage us for a Managed Security Provider Effectiveness & Integration Review focused on scope, governance, integration, performance, and value.
Organization, roles, management structure, service ownership, governance, and operating cadence.
Service definitions, customer segmentation, dedicated and shared models, responsibilities, and entitlement differences.
Staffing model, workload distribution, 24x7 coverage, shifts, tiers, analyst capacity, management span, and growth assumptions.
Alert routing, queues, case management, assignment, handoffs, client context, and standardization.
Ownership, shared and client-specific content, tuning, content lifecycle, telemetry variability, and feedback loops.
Severity, escalation, SLAs, notification, client-specific procedures, and emergency contacts.
QA, case quality, rework, escalation quality, shift consistency, and service consistency across clients.
Meaningful service measures, SLA structure, operational and customer reporting, and executive visibility.
Intake, requirements, telemetry, playbooks, escalation procedures, and handoff into steady-state operations.
SIEM, EDR, SOAR and case platforms, integrations, multi-tenant workflows, usability, and scalability.
Analyst augmentation, triage and investigation assistance, consistency, customer-context handling, data segregation, human oversight, quality, and measurable operational value.
Orchestration, repetitive analyst work, enrichment, routing, notification, scalable deterministic workflows, and failure handling.
Bottlenecks, capacity constraints, process friction, standardization, operational leverage, and continuous improvement.
The work focuses on security operations and managed-service delivery, not M&A, valuation, or financial advisory.
04 / Audiences
Teams seeking a rigorous outside view of security operations, detection and response, readiness, AI adoption, or a specific performance challenge.
Organizations that need a clearer view of program risk, priorities, provider arrangements, and the practical path to stronger cybersecurity capabilities.
Security-service organizations improving multi-client operations, service delivery, scalability, quality, customer experience, AI use, or operational efficiency.
Organizations that need senior security operations expertise for subcontract, white-label, subject-matter expertise, workshop, assessment, or client-facing work.
05 / Engagements
Assessments, focused reviews, and tabletop exercises with an agreed scope, timeline, and deliverables.
Recurring senior guidance around a defined initiative, operating challenge, or improvement program while the client retains operational ownership.
Embedded, part-time leadership with defined responsibilities, capacity, cadence, and availability. This does not imply 24x7 coverage.
Subcontract, white-label, subject-matter expertise, workshops, assessments, or client-facing support for consultancies, managed security providers, technology companies, and related firms.
06 / Founder
I’ve spent my career building, scaling, and leading security operations.
I started in SIEM, detection, and security consulting before moving into SOC leadership and progressively larger operational mandates. That included leading North American SOC and NOC operations within a global follow-the-sun model, and later a 24x7 security operations organization of 50 supporting more than 250 enterprise clients.
Across those roles, the constant has been scale: larger teams, more complex environments, more clients, and higher expectations for operational maturity and performance.
Today, I work at the intersection of security operations and business risk, translating between the technical realities analysts face and the priorities executives need to understand.
View Drew's professional backgroundSelected operating scale from Drew Sutter's career
07 / Contact
Whether you need to improve security operations, assess a cybersecurity program, strengthen incident readiness, or improve managed security delivery quality, start with a conversation about the situation.
Share the challenge, the kind of support you are considering, and any relevant timing.
For your security, please don't send credentials or sensitive incident data by email.
San Diego, California · Remote and select on-site engagements available