Cyber Analysis reports use a consistent analytical methodology. The dimensions examined and depth of analysis depend on the agreed scope and available evidence; not every commission examines all seven dimensions equally.
The purpose of the methodology is not to produce predetermined answers or predetermined levels of risk. Its purpose is to support a structured process within the agreed scope, allowing observations to be examined carefully before conclusions are reached.
Cybersecurity is rarely defined by a single weakness. Risk often emerges through the relationship between technology, governance, operational practice and organisational decision-making. The Cyber Analysis Methodology is designed to examine those relationships through evidence-led analysis.
The Cyber Analysis Methodology is designed to examine the relationships between technology, governance, operational practice and organisational decision-making through evidence-led analysis.
Each assessment begins by examining the available evidence about systems, identities, cloud services, applications and external dependencies. The objective is to establish what that evidence shows about potential exposure, while identifying what remains unverified.
Security controls reduce risk only when they are implemented, maintained and understood. This stage examines the security measures that protect organisational systems and considers how those controls contribute to the overall security posture.
Technology alone does not determine cybersecurity. Governance influences priorities, accountability, decision-making and oversight. This stage examines how cybersecurity responsibilities are organised and how security decisions are supported across the organisation.
No organisation can eliminate every cybersecurity risk. Resilience considers how well an organisation prepares for disruption, responds to security incidents and recovers when unexpected events occur.
Modern organisations depend upon suppliers, software vendors, cloud providers and external services. Where included in the agreed scope, the assessment examines what the available evidence shows about how those relationships influence cybersecurity.
Everyday operational practices often have a greater influence on security than technology alone. Processes, communication, access management, change management and routine activities all contribute to an organisation's overall security posture.
After the areas within the agreed scope have been examined, observations are considered together. This final stage identifies patterns, relationships and potential implications that may not be visible when individual findings are viewed in isolation.
The objective is not simply to identify issues. It is to develop a balanced understanding of organisational cybersecurity through structured analysis.
Every Cyber Analysis report is guided by a common set of principles. These principles help ensure that every report remains consistent, transparent and focused on improving organisational understanding rather than supporting predetermined outcomes.
The Cyber Analysis Methodology is intended to provide consistency rather than certainty. Organisations differ. Technologies change. Risks evolve.
Applying the same structured approach to every investigation helps produce reports that are transparent, repeatable and grounded in careful analysis.
Every report begins in the same place. With observation. Every conclusion is expected to follow from the evidence examined throughout the investigation.