FOR ORGANIZATIONS
Cybersecurity Initiative Traction Diagnostic
One security initiative.
A clearer read on what is stopping it from moving or holding in practice.
What is It
This is a bounded, evidence-led diagnostic for one defined initiative. It is not a general culture assessment and it is not a technical security assessment.
Use the Traction Diagnostic when the technical or strategic decision already exists, but the organisation still needs to understand what is happening around ownership, authority, workflow, incentives, stakeholder dependencies or evidence before more rollout effort is justified.
This is the right engagement when
- there is one defined security initiative, control, policy, tool, remediation or funded capability to examine;
- a sponsor or credible route to one exists;
- the problem is specific enough to ask what is not moving, being used or holding in practice;
- the organisation can provide the people and existing materials needed to test assumptions;
- a decision is required about whether to proceed, proceed with conditions, pause, reframe or design the next stage.
If the conversation is still at the level of general interest, there is no credible sponsor route, or the work is primarily technical, audit, GRC or incident-response work, I will not turn that into a Diagnostic.
Process Discipline · Evidence Before Assumption
What the Diagnostic examines
The Diagnostic works from evidence around the initiative rather than from a generic adoption checklist.
- the risk, control, implementation or decision problem behind the initiative;
- which people, roles, teams or business units are affected and what they need to do differently;
- where ownership, authority, decision rights, accountability or local reinforcement are unclear;
- what workflow friction, capability gaps, incentives, stakeholder dependencies or communication / enablement gaps are working against execution;
- what would count as effectiveness evidence rather than completion evidence, and who is responsible for reporting it.
How the work runs
1. Frame the initiative
We agree the specific initiative, the decision that matters, who is affected and what is not landing.
2. Gather evidence
Two to three stakeholder interviews with the people closest to ownership, delivery and local execution, plus review of the initiative material you already hold.
3. Analyse the conditions
I examine ownership, authority, workflow, incentives, stakeholder dependencies, communication / enablement and the available evidence of effect.
4. Prepare the findings pack
You receive a concise, decision-oriented summary of the barriers, implications and next-step options.
5. Readout and decision
A 90-minute working session with the sponsor and named stakeholders tests the findings and closes on the next decision.
The analysis is structured and evidence-led. The Diagnostic is not presented as a validated or predictive model.
What you leave with
You leave with a specific, evidence-based read of what is affecting the initiative — rather than a vague conclusion that ‘adoption is weak’ or people are resistant.
- a documented read of the main organisational conditions affecting this initiative;
- a clearer separation between evidence, assumptions and unresolved questions;
- the ownership, authority, workflow or incentive issues that require a decision rather than another communication activity;
- the evidence that would show effect rather than completion;
What this Diagnostic does not do
- It is not a vulnerability assessment, penetration test, technical control assessment, audit or GRC certification review.
- It does not redesign reporting lines or incentive schemes, or formally audit governance.
- It does not include implementation, communication campaigns, ambassador networks, workshops or pilots unless separately justified and scoped.
- It does not claim behaviour change, risk reduction or incident reduction from a 2–3 week diagnostic.
Technical security, GRC, audit and engineering specialists remain responsible for their own domains. This Diagnostic examines the organisational conditions around execution alongside that expertise.
Format and investment
ELEMENT
SCOPE
DURATION
Typically 2–3 weeks
STAKEHOLDER INTERVIEWS
Two to three
MATERIAL REVIEW
Existing initiative material only; no new documentation required for review
FINDINGS
Concise decision-oriented findings pack
READOUT
One 90-minute working session with the sponsor and named stakeholders
INVESTMENT
From EUR 3,500 net, plus VAT where applicable
SCOPE CONTROL
Additional interviews, sites, business units, a second readout or implementation activity are separately scoped and agreed in writing
What happens after
The Diagnostic ends in a decision, not automatically in more work.
If the findings justify further rollout design, the next stage may be a separately scoped Rollout Design, with its own scope and investment.
If the issue appears structural and recurring across initiatives rather than specific to the one examined, I name that as outside the current Diagnostic scope rather than expanding the engagement.
Start with one live initiative
