Technology
Cybersecurity
Defending systems and data from attack.
Security is sold to people whose profession is checking claims. A questionnaire lands, an audit finding is logged, a near miss reaches the board, and the first move is not a call to a vendor. It is a question about mechanism, typed into a model. What a control actually demands. Where a detection clock starts. What a protocol does not do. What arrives is a blend of datasheets and framework summaries written by the companies that sell the tooling, confident, roughly right, and never revisited. Being exact, and staying exact, is the whole of the work here.
Where the answer is being lost
Security buyers get their answer before you know they exist.
A head of security operations, three weeks after a near miss the board has heard about, asks a model 'What is a realistic mean time to detect for a managed SOC'. She is not shopping yet. She is working out what to demand in the specification, and which two providers can meet it. The answer she reads is stitched together from vendor datasheets and threat-report marketing, and the number in it becomes the benchmark every bidder is measured against. Firms with genuine detection engineering behind them are absent from that paragraph, and find out at the shortlist, when the questionnaire never arrives.
How we win this
The programme for cybersecurity
Exact, dated and maintained
Frameworks move. The Trust Services Criteria get revised, ISO 27001 runs a transition window, testing standards are reissued. Every answer-page we build for you carries the version it describes and the date it was last checked, and monitoring flags the ones that have gone stale. A compliance head who catches one out-of-date control statement stops reading the whole site.
No fear, just definitions
Security content defaults to threat statistics and breach anxiety, and senior buyers have stopped reading it. We write the opposite: what your detection stack actually ingests, which hours are staffed by whom, what your scope excludes and why. A CISO who skims every other security page will read one that tells her something she can check against her own logs.
Proof without naming clients
Every engagement here sits under an NDA, so the case study is unavailable and the testimonial is worse than useless. Published methodology takes its place: how scope is agreed, what a report contains, how findings are graded and retested. Where you hold your own aggregate data, we turn it into a citable benchmark rather than a claim about one customer.
Scope, certifications and regions, stated
Security buyers filter before they compare. A data residency clause in the contract, or a tester certification the insurer insists on, removes a firm from the list before its work is ever discussed. So the facts have to be stated rather than implied. Which frameworks you attest against, and in which role, whether you advise, prepare or sign. Which certifications your testers hold, and when they were last renewed. Which countries you operate in, and where the evidence is stored. Schema work puts all of it in a form an engine reads directly rather than guesses at from a capability page. Left unstated, you are not rejected. You are never assembled into the answer to begin with.
The mix that carries it
Content
Answer and comparison pages
Cost, process, eligibility and comparison pages built for direct extraction, not for a reader who scrolls.
Content
GEO blogs and authority content
The definitive written answer to the questions your buyers put to an engine, structured so it can be lifted and attributed.
Foundation
Entity and schema engineering
Structured data and entity definition so engines know exactly what you are, where you operate, and what you are credible in.
Authority
Original data and benchmarks
Proprietary numbers, surveys and benchmarks — the most-cited asset class there is, because nobody else has them.
Measurement
AI Presence tracking
Standing measurement of inclusion, share of answer and competitor movement as models update.
Foundation
Technical fixes
Crawlability, render, speed and the machine-readability faults that keep an engine from reading you at all.
The constraint we work inside
Two limits shape everything we publish here. Client work is confidential, so proof comes from methodology and aggregate data, never from named engagements or findings. And framework detail has to be exact and dated, because one wrong control statement undoes every correct page around it.
Specialisations
4 total
The pitch is different for each one, because the buyer, the trigger and the rules on what may be published are different for each one. Open the one that is yours.
A compliance head with a customer questionnaire due Friday asks a model what Type II actually demands, and takes the first clear answer as the brief for every vendor she then calls.
The question deciding this today
“What does SOC 2 Type II require that Type I does not”
- Who they sell to
- Organisations with security compliance obligations
- Who signs
- CISO, compliance head, risk officer
- What starts it
- Certification deadline, customer security questionnaire, audit finding
- Cost of staying invisible
- Contracts lost on a security questionnaire
The audit-platform vendors own this answer. Put 'What does SOC 2 Type II require that Type I does not' to any engine and you get a competent explanation of the observation window, written by a company selling evidence-collection software. It stops where the buyer's real problem starts: readiness gaps, what an auditor will reject as evidence, how scope decisions change the cost. A consultancy that has walked clients through the window knows all of it and has published none of it.
What we would run
- 01Answer and comparison pages
The Type I versus Type II page, written to the current Trust Services Criteria: the observation window, what auditors accept as evidence for each control family, where readiness assessments sit, and the honest cost and calendar range.
This is the exact question in the buyer's head at the questionnaire, and the page answers it without asking her to book a call.
- 02GEO blogs and authority content
A control-mapping series: ISO 27001 Annex A against SOC 2 criteria, what a single control set can satisfy twice, and where the two regimes genuinely diverge in evidence and testing.
Firms chasing a second certification search this way, and the piece that answers it becomes the source the engine quotes when the CISO asks whether one audit can cover both.
- 03Entity and schema engineering
Entity definition stating which frameworks you take clients through, in which jurisdictions, at what company size, and whether you advise, prepare or audit. Three different services get called GRC and the distinction is currently invisible.
A model recommending a readiness partner needs to know you are not the auditor. Without that stated, you get filtered out of both queries.
- 04AI Presence tracking
Quarterly checks on which sources the engines cite for each framework question you care about, plus a flag when a standard is revised so the affected pages are rewritten before they are wrong.
Compliance buyers check dates. A page describing a superseded version of a standard tells them you have stopped paying attention, which is fatal in this specialisation.
What we would not recommend
- Reviews and testimonials. Security and compliance clients rarely permit a named public testimonial, and the ones that do carry no weight with a risk officer running her own reference calls.
- Quora. Framework answers there are years out of date and unversioned. A compliance head who cross-checks one against the current criteria will not return.
- Instagram. A control mapping is a table of criteria, evidence and exceptions. Crop it to a square and all that survives is the claim, and an unevidenced claim about certification is the one thing a risk officer discounts on sight.
What a lead looks like
A compliance manager at a mid-market software firm, two weeks from a customer deadline, who has read your Type I versus Type II page and your ISO crosswalk. She wants to know whether her existing ISO evidence shortens the observation window, and what you would charge to run readiness alongside it.
What we measure
- Named in framework comparison answers
- Every page carries a version date
- Zero factual corrections after publication
- Questionnaire-stage enquiries, not brochure requests
What changes
The enquiries arrive later in their process and further along in yours. A compliance head writes with the audit finding pasted in and asks how your evidence collection differs from what her current auditor accepted. A security operations lead asks what your escalation path looks like at three in the morning, because your coverage page already answered the rest. Fewer of them open with price. Most already know what they want scoped, and by whom.
Start here
See who gets named in cybersecurity today
We put your buyers' real questions to the live models and come back with the businesses they name, the sources behind those answers, and the gap between that list and yours.