Skip to content
CYBER

The four Ds guide security direction. Five stages deliver the work.

Hyper Directional Security and the five delivery stages serve different purposes. Direction, Diagnose, Design and Defend describe the continuous security cycle around business change. Understand, Assess, Prioritise, Deliver and Assure describe how an individual engagement moves from a question to an evidenced result.

How the two models connect.

  1. Direction

    Sets the business context and desired outcome. It is established through Understand and sharpened during Prioritise.

  2. Diagnose

    Finds and validates material weaknesses. It is delivered primarily through Assess.

  3. Design

    Turns priorities into proportionate controls, requirements and decisions. It begins in Prioritise and continues through Deliver.

  4. Defend

    Puts controls into operation, prepares response and verifies effectiveness. It is delivered through Deliver and sustained through Assure.

Risk first. Technology second.

We begin by establishing which services cannot stop, where sensitive information is held, who has powerful access, which suppliers matter and what obligations apply.

A technology discussion before those questions are answered can lead to more activity without a better security decision.

Five stages from question to assurance.

What we do, what we need from you, and what you receive at each one.

  1. Understand

    We learn how the organisation creates value, which operations and information matter, how responsibility is assigned and what change is planned.

    What we need
    People who understand the business, operations, technology and relevant obligations.
    What you receive
    An agreed scope, business context and the questions the work must answer.

  2. Assess

    We evaluate risks, controls, systems, architecture and supplier dependencies, then review the evidence behind material claims.

    What we need
    Available evidence and authorised access where technical review is required.
    What you receive
    Findings ranked by business impact, with evidence, limitations and practical meaning.

  3. Prioritise

    We agree treatment decisions, owners, effort and sequence with the people who will carry the actions.

    What we need
    Decision makers and action owners in the room.
    What you receive
    A realistic plan that reflects risk, available capacity and business timing.

  4. Deliver

    We support remediation, design, governance and implementation where the client wants help beyond the plan.

    What we need
    Access to the teams and suppliers responsible for delivery.
    What you receive
    Implemented changes, updated documentation and evidence captured as work progresses.

  5. Assure

    We verify that priority improvements operate as intended and continue to support the required outcome.

    What we need
    An agreed review rhythm and access to current evidence.
    What you receive
    Retest results, current risk decisions and a clear view of remaining exposure.

How the work stays controlled.

  • Fixed scope is used where the question can be bounded, with assumptions and exclusions stated in writing.
  • Leadership and delivery audiences receive information at the level each needs.
  • Findings include evidence and limitations, not only a rating.
  • Regional and sector requirements are mapped into one control approach where practical.
  • No certification, compliance or complete security outcome is guaranteed.