How JandaSec looks at cyber risk

More than a score

Cyber risk is rarely about one control failing in isolation. The useful question is not only “how serious is this?” but “what could this weakness enable, amplify or make harder to recover from?”

JandaSec looks at risk in context: the business, its technology, customers, critical services, growth plans and operating reality. Findings are assessed for their likely business significance, the part they could play in an incident and how they interact with other weaknesses.

We are deliberately transparent about assumptions, evidence gaps and uncertainty. Risk judgements are there to support decisions, not create false mathematical precision.

Role classification

The role classification describes what a weakness can do in an incident. It is not a second severity score.

Breach Enabler

Could this weakness help someone gain unauthorised access?

Breach Amplifier

If access is gained, could this increase reach, privilege or damage?

Impact Multiplier

Could this make an incident harder to detect, contain, respond to or recover from?

Foundational Weakness

What underlying governance, ownership, process or hygiene problem is allowing risk to persist?

Swiss-cheese reasoning

Cyber incidents rarely come from one spectacular failure.

JandaSec applies Swiss-cheese reasoning to cybersecurity. Serious incidents often emerge when several ordinary weaknesses line up: an exposed service creates the route in, excessive privilege increases reach, weak monitoring delays detection and untested recovery turns compromise into prolonged business disruption.

The job is not to pretend every hole can be removed. It is to understand the layers, stop weaknesses aligning, strengthen the foundations and know which failures would matter most.

From evidence to improvement

JandaSec does not assess, write a report and disappear. The working sequence is:

1. Context — understand the business, technology, customers, critical assets, maturity, constraints and objectives.
2. Evidence — test the difference between stated controls and what can actually be demonstrated.
3. Risk — judge business significance and the role each weakness could play in an attack, incident or assurance failure.
4. Priorities — separate immediate exposure from longer-term maturity improvement.
5. Improvement — turn findings into an actionable Continuous Security Improvement Plan with ownership, timing and closure evidence.
6. Assurance — challenge progress, verify closure, test readiness and provide evidence rather than unsupported confidence.

Positive assurance

JandaSec records Cybersecurity Observed Strengths as well as risks. Mature assessment should preserve what works, not only catalogue gaps.