Home / How We Work
From a security concern to an owned plan.
Good delivery begins with an accurate scope and ends with a clear next step. CyberXpert uses a practical process that connects business priorities, technical evidence and accountable action.
01
Understand the need
We establish what your organisation is trying to protect or achieve, who owns the relevant systems and what has prompted the work.
Useful inputs include an asset overview, existing security tools, relevant customer requirements, recent changes and any known constraints. Please share sensitive material only through an agreed secure route.
02
Agree the engagement
We define the objectives, deliverables, access needs, assumptions and exclusions in a proposal or statement of work.
For testing, rules of engagement establish written permission, allowed techniques, test windows and stop conditions. For managed services, hours, escalation and response authority must be explicit.
03
Deliver with context
We gather evidence and perform the agreed assessment, implementation or operational work.
Changes are planned around business needs, with appropriate testing and rollback considerations. Material scope changes are discussed before additional work is assumed.
04
Explain and prioritise
Findings need to make sense to both technical teams and decision-makers.
We distinguish urgent exposure from longer-term improvement, explain the basis of recommendations and identify dependencies. A debrief gives stakeholders a chance to challenge assumptions and clarify decisions.
05
Hand over and improve
We agree owners and practical follow-through for the work that remains.
Retesting, reassessment or ongoing support is specified separately where needed. Reviews revisit risk as systems, suppliers and business requirements change.
A proposal should make decisions easier.
Expect a clear objective, defined assets or services, named responsibilities, useful deliverables and transparent exclusions. Pricing factors, delivery assumptions and any customer preparation are set out before work starts.
Before commissioning, check:
- Purpose and boundary: the decision the work supports, in-scope systems and exclusions.
- Authority and preparation: approved access, supplier permissions, change approvals and stop contacts.
- Outputs and assurance: useful evidence, report review, a debrief and any included retest or follow-up.
- Commercial scope: fees, licences, third-party charges, service coverage and any separately charged work.
- Handover: action owners, validation evidence and the agreed handling of access and engagement information.
A practical next step starts with a conversation.
Tell us what your organisation needs to achieve. We will help define a proportionate scope, useful deliverables and clear responsibilities.