Current-state profile
Controls, decision rights, architecture and tools today, with the gaps against the reference written down.
Who uses itCISO, CIO
Solution 5 of 6
Build & Transform Cybersecurity
Turn a long list of projects into a program with a target, owners and measures that show progress.
- 01Understand
- 02Design
- 03Transform
- 90%of non-executive directors lack a measure of confidence in cybersecurity value. Only 10% are strongly confident.Gartner board survey, 2025
- 19%of organizations say their cyber resilience exceeds their requirements, up from 9%. 64% say it meets the minimum.WEF Global Cybersecurity Outlook 2026
- 85%of insufficiently resilient organizations cite missing skills and people. Among highly resilient ones it is 22%.WEF Global Cybersecurity Outlook 2026
- $8Maverage cost of a data breach for Middle East organizations, against $4.99M globally.IBM Cost of a Data Breach 2026
The problem
A finished project is not a stronger program.
In Gartner’s 2025 survey of 330 non-executive directors, 90% said they lack a measure of confidence in cybersecurity value. In the World Economic Forum’s 2026 outlook, 64% of organizations said their resilience meets the minimum requirement and 19% said it exceeds it. The work is happening. Proof that it adds up is harder to find.
Project lists grow from audits, incidents, vendor offers and regulator questions. Each item has its own sponsor and budget, but nothing ties them to one agreed target. So the list cannot be sorted by what changes risk, and nobody can say when enough has been done. Gartner’s own analysts say boards “struggle to connect cybersecurity investments to real business outcomes.”
The WEF data shows what follows: 85% of insufficiently resilient organizations cite missing critical skills and people, against 22% of highly resilient ones.
Skills needs, ISC2 2025
- 95%Organizations with at least one skills needOnly 5% report none
- 59%Critical or significant skills needsUp from 44% in 2024
- 23%Critical skills needsA subset of the 59%
The three groups are nested categories from one survey, not a process. ISC2 2025 Cybersecurity Workforce Study, 16,029 practitioners surveyed in July and August 2025.
- 9% → 19%Organizations saying resilience exceeds their requirements2025 report to 2026 report
- 44% → 59%Organizations with critical or significant skills needs2024 to 2025
What you hold
What you can use the week we finish.
| Outcome | Owner | Measure | Status |
|---|---|---|---|
| Admin access is strong everywhere | CIO | Admins on hardware keys | On track |
| Attacks are seen within an hour | CISO | Hours to detect | At risk |
| Payments restore in 2 days | COO | Tested restore time | At risk |
| Every project ties to an outcome | PMO | Projects with an owner | On track |
Outcomes moved toward target
3 of 5from 1 of 5
Projects with an owner and outcome
88%from 31%
Overlapping tools retired
7from 0
Target state and strategy
Where security needs to be and why, in business terms, with the outcomes that define it.
Who uses itCEO, CISO, board
Operating model
Roles, decision rights and forums, what is held in-house and what is bought, and how the CISO role is covered.
Who uses itCISO, CIO, HR
Sequenced roadmap
The projects that remain, in order, each tied to an outcome, an owner and a budget line.
Who uses itCISO, CFO, program office
Measures and board view
A short set of measures against the target, reported at a steady rhythm.
Who uses itCISO, board
Where this starts
Start with the question you are stuck on.
Choose a question4 questions · select any
- Where we would start
- We compare where you are with where you need to be, then sort the list by what each project moves.
- Who works on it
- Strategy consultants and security architects.
- What you hold at the end
- A sequenced roadmap, with each item tied to an outcome and an owner.
- Where we would start
- We agree which decisions a senior security leader owns, then cover them within a defined scope.
- Who works on it
- Senior security leaders who have run programs.
- What you hold at the end
- A written scope, clear decision rights and a handover plan.
- Where we would start
- We write the strategy in business terms, with a target state and a few measures.
- Who works on it
- A strategy lead and an executive advisor.
- What you hold at the end
- A board-ready strategy and a regular view of progress against it.
- Where we would start
- We map what you run today, set design principles, and decide what to keep, simplify or replace.
- Who works on it
- Security architects and engineers.
- What you hold at the end
- A target architecture, design principles and a phased path to get there.
How it works
How the work runs, step by step.
- Govern1.5
- Identify2
- Protect2.5
- Detect1.5
- Respond1
- Recover1
TodayTarget
We compare where you are with where you need to be. That covers current controls, how security decisions get made, who owns what, how the architecture grew, and what the board and regulators expect. We write the gap down against a common reference, such as NIST CSF 2.0 profiles.
- We work from
- Current strategy and project lists, control and tool inventories, architecture documents, org charts and budgets, interviews with security, IT and business leaders.
- You get
- A current-state profile, the gaps against an agreed reference, and the project list mapped to those gaps.
| Capability | Decides | Held | Forum |
|---|---|---|---|
| Strategy and risk appetite | CEO, CISO | In-house | Quarterly board |
| Security architecture | Chief architect | In-house | Design review |
| 24-hour monitoring | CISO | Bought | Monthly service review |
| Incident forensics | CISO, counsel | Retainer | On call |
| Testing and red team | CISO | Bought | Twice a year |
We set the target and the way to reach it. That means a strategy in business terms, an operating model (roles, decision rights, what you hold in-house and what you buy) and architecture principles. Then we sort the project list against the gaps: keep, change, merge or stop.
- We work from
- The gap list, business priorities, risk appetite, budget and capacity, regulatory expectations.
- You get
- A strategy, an operating model, architecture principles, and a sequenced roadmap with an owner for each outcome.
Q1Q2Q3Q4
Identity and admin access
Detection coverage
Merge overlapping tools
Tested recovery
Stop: legacy dashboard project
We stay with the work through delivery. We set up governance, track a few measures, and adjust the roadmap as threats and business plans change. We also review the architecture and the tools in use as they age. Ownership moves to your team.
- We work from
- Roadmap and owners, delivery status, measures, incident and audit findings, changes in business plans.
- You get
- Working governance and reporting, a roadmap kept current, and a team ready to run the program.
A different way to look
The same work, two ways to run it.
50projects
40delivered on time
10late
| Project | Status | Budget | Outcome |
|---|---|---|---|
| New email filter | Delivered | On budget | Unclear |
| Endpoint tool upgrade | Delivered | On budget | Unclear |
| Log platform rollout | Late | Over | Unclear |
| Vendor risk portal | Delivered | On budget | Unclear |
| Awareness campaign | Delivered | On budget | Unclear |
- Unit of work
- A project with a start and an end
- How work is chosen
- Whoever asked, the latest audit or incident, a vendor offer
- Who decides
- Each project’s sponsor
- What gets reported
- Projects delivered, on time and on budget
| Outcome | Owner | Moved this quarter | Why |
|---|---|---|---|
| Admin access is strong | CIO | Yes | Hardware keys at 70% |
| Attacks seen within an hour | CISO | Yes | Two routes now covered |
| Payments restore in 2 days | COO | No | Offline copy not funded |
| Tool count under 25 | CIO | No | Two contracts auto-renewed |
| Every project has an owner | PMO | Yes | 88% done |
- Unit of work
- An outcome with an owner
- How work is chosen
- The gap between current and target state, ranked by what it changes
- Who decides
- A named forum with decision rights
- What gets reported
- Movement against the target, and the measures tied to decisions
What leadership hears
We delivered 40 of 50 projects.→
Three of our five outcomes moved this quarter. Two did not, and here is why.
Common mistakes
Beliefs worth dropping.
“More tools mean more coverage.”
Gartner counts more than 3,000 cybersecurity vendors. A tool covers something only if it is deployed, tuned and owned. Gartner lists technology optimization among its 2025 trends and points to consolidating and validating core controls. Which tools to keep is an architecture decision, not a purchasing one.
“We need to hire more people.”
In ISC2’s 2025 study, 34% said their staffing level is right, yet 59% had critical or significant skills needs. The top gaps were AI (41%) and cloud security (36%). ISC2’s own heading is that skills shortages eclipse staff shortages. More headcount does not close a skills gap. The operating model decides what to build, borrow or buy.
“Adopting a framework means we have a program.”
NIST says the framework does not prescribe how outcomes are achieved. It gives a common language, and a way to describe a current and a target profile. Govern covers strategy, expectations, policy, roles and oversight. The program is the work of closing the gap between those two profiles.
Regional view
What it costs in the Middle East.
IBM’s 2026 study puts the average breach in the Middle East at $8 million, against a global average of $4.99 million. In the Middle East data, financial and technology organizations each averaged $10.67 million. IBM lists an inability to prioritize threats and excessive privileges among the factors that raised cost. In the WEF’s 2026 survey, 84% of Middle East and North Africa respondents expressed high confidence in protecting critical infrastructure. A program gives that confidence something to be measured against.
- Middle East, financial and technology sectors, 2026$10.67M
- Middle East, 2026$8.00M
- Global, 2026$4.99M
Average cost of a data breach, 2026. IBM. The Middle East and sector figures are from IBM’s Middle East findings.
Standards we work from
- NIST Cybersecurity Framework 2.0Our common language for Govern and for describing current and target profiles. It does not prescribe how to reach them.
- ISO/IEC 27001:2022The requirements for an information security management system that we map operating model and improvement cycles to.
- ISO/IEC 27014:2020Guidance on governing information security: how top management evaluates, directs, monitors and communicates it.
Using a standard as a common language is not certification or endorsement.
Where our specialists come in
Specialist work, placed along the lifecycle.
Your problem decides which of these we use. You do not have to pick.
- Govern
- Identify
- Protect
- Detect
- Respond
- Recover
- Comply
- Evolve
Govern
Direction and accountability
- Cybersecurity Strategy
- vCISO & CISO Advisory
- Cyber Risk & Governance
- Board & Executive Advisory
Identify
Know your exposure
- Security Maturity Assessments
Protect
Build the right controls
- Security Architecture
- Security Engineering
Recover
Restore and improve
- Cyber Resilience
- Security Remediation
- Post-Incident Improvement
Evolve
Adapt and transform
- Continuous Security Improvement
- Security Transformation
- Security Architecture Evolution
- Security Engineering & Optimization
Read first
What our practitioners have written on this.
Executive Briefing
What Should a CISO Actually Measure?
Most CISO dashboards show how busy the security team is. Leadership needs to know whether the business is less exposed than it was last quarter.
Cybrilliant Security Strategy SME
Read →Article
Cybersecurity Strategy in a Fast-Growing Enterprise
When the business changes every quarter, strategy is mostly about sequencing, standard choices and what you decide not to do.
Cybrilliant Security Strategy SME
Read →Practitioner Field Note
Security Remediation Governance
Findings pile up when the person who owns the risk does not own the fix. How to set ownership, deadlines, exceptions and closure so that “closed” means fixed.
Cybrilliant Security Remediation SME
Read →Research / Report
Research: Security Operating Model Options
Five ways to organize security delivery, the conditions under which each holds, and the capabilities that cannot be handed over.
Cybrilliant Security Strategy SME
Read →Technical Explainer
Measuring Control Effectiveness: From Deployment Coverage to Detection Evidence
“95% of endpoints have the agent” says where a control is installed. It does not say what the control does. A five-rung evidence ladder for separating coverage,…
Cybrilliant Security Engineering SME
Read →Decision Framework
The CISO Operating Model: What Should Be Internal and What Can Be Partner-Led?
A way to decide which security capabilities to own, which to share and which to buy, and where the model tends to break.
Cybrilliant Security Strategy SME
Read →Questions
What people ask before they start.
How is a strategy different from a roadmap?
A strategy says where security needs to be and why, in terms the business accepts. A roadmap says what work gets you there, in what order, with what owner. A roadmap without a strategy is a project list in a different layout.
When does a virtual CISO make sense?
When you need senior security leadership but not a full-time hire, or the role is vacant or stretched. We agree the scope first: which decisions we own, which stay with you, and how we hand over.
How is a maturity assessment different from an audit?
An audit checks you against a requirement. A maturity assessment compares what you do with a reference you choose, such as a CSF 2.0 profile, and sets a target. It tells you what to build next. It is not a pass or fail result.
What will our board see?
A short view: the outcomes you committed to, movement against each, what is behind, and what decision is needed. Gartner advises giving boards transparency on actual exposure and readiness, not general threat trends.
Do we have to stop the projects already running?
No. We sort the current list against the gaps and recommend which to keep, change, merge or stop. You decide. Work already funded often fits once it is tied to an outcome.
Sources and notes
- Gartner, Survey Finds 90% of Non-Executive Directors Lack a Measure of Confidence in Cybersecurity Value (Nov 24, 2025)
- Gartner, Identifies the Top Cybersecurity Trends for 2025 (Mar 3, 2025)
- Gartner, Identifies Strategic Focus Areas for CISOs Amid Rising Hype and Scrutiny (Jun 9, 2025)
- World Economic Forum, Global Cybersecurity Outlook 2026: The trends reshaping cybersecurity
- World Economic Forum, Global Cybersecurity Outlook 2026: Executive summary
- ISC2, 2025 Cybersecurity Workforce Study
- IBM, Cost of a Data Breach Report 2026
- IBM Middle East newsroom, Cost of a Data Breach 2026 Middle East findings
- NIST, Releases Version 2.0 of Landmark Cybersecurity Framework (Feb 26, 2024)
- NIST, The NIST Cybersecurity Framework (CSF) 2.0 (CSWP 29)
- ISO, ISO/IEC 27001:2022
- ISO, ISO/IEC 27014:2020