Decision before activity
We define the question, decision owner, required confidence, and deadline before selecting tools or tests.
← Ananke Labs
How we work
From a security question to a verified decision.
Every engagement starts with the decision the client needs to make. We establish authority and boundaries, examine the system, keep evidence traceable, communicate material issues early, and remain involved through remediation and verification.
What governs every engagement
The method changes with the problem. These commitments do not.
Written authority and safe boundaries
Scope, permissions, exclusions, data handling, escalation, and stop conditions are agreed before technical activity.
Evidence with honest limits
We separate observation from inference and state what was not tested, what is uncertain, and what the evidence cannot support.
Action over report volume
Work is organized around material risk, practical remediation, accountable owners, and verifiable closure.
The engagement journey
Frame the decision
Agree the business objective, critical service, security question, stakeholders, criteria, confidence, and decision date.
Authorize and scope
Confirm authority, systems, people, locations, third parties, access, exclusions, safety controls, evidence rules, and escalation paths.
Establish the baseline
Map the system, obligations, threats, controls, dependencies, existing evidence, known issues, and assumptions that need challenge.
Examine and challenge
Review records, interview owners, trace workflows, sample operation, test technical behavior, and preserve reproducible evidence.
Decide and act
Communicate material issues early, explain impact and uncertainty, prioritize treatment, assign owners, and record risk decisions.
Verify and close
Retest agreed changes, confirm evidence, record residual risk and exceptions, transfer the final record, and define the next review point.
Two working lanes
Ananke Labs can help a client reach the required state and can separately test whether the resulting evidence supports reliance. The role is made explicit in every scope.
Make the control real
Used for security engineering, readiness, remediation, and compliance operations. We help turn requirements and risks into controls that teams can run.
- Control architecture and technical specifications
- Implementation and remediation support
- Operating procedures, evidence, metrics, and ownership
- Readiness, handover, and improvement backlog
Test what is claimed
Used for security assessments, adversarial testing, and assurance. We examine whether controls and systems behave as stated and what the evidence supports.
- Objective criteria and defined control claims
- Independent examination and technical challenge
- Exceptions, limitations, and residual risk
- Evidence-based conclusion and closure validation
The working agreement
What we need from the client
- A named sponsor and decision owner
- Written authority for the agreed activity
- Timely access to systems, evidence, and relevant people
- Accurate disclosure of dependencies, restrictions, and known risks
- Named contacts for operational escalation and material findings
- Ownership of remediation, exceptions, and risk acceptance
What the client can expect from us
- A named engagement lead with direct accountability
- A clear scope, method, schedule, roles, and acceptance criteria
- Proportionate safety controls and careful evidence handling
- Prompt escalation of material risk or unsafe conditions
- Regular status, decisions, dependencies, and change control
- Clear separation of fact, inference, limitation, and recommendation
During the engagement
- Approved scope, assumptions, exclusions, and rules of engagement
- Evidence request and secure transfer plan
- Working record of activities, samples, observations, and limitations
- Immediate escalation route for material findings
- Decision, dependency, exception, and action log
- Controlled handling, retention, and deletion of sensitive evidence
At closure
- Executive brief tied to the original decision
- Technical evidence and reproduction or validation conditions
- Affected controls, systems, dependencies, and business impact
- Prioritized remediation with owners and acceptance criteria
- Limitations, unsupported claims, exceptions, and residual risk
- Retest results, closure status, and the next decision point
Common questions
How is scope agreed?
We start from the decision, critical service, risk, authority, available evidence, and deadline. The proposal records inclusions, exclusions, assumptions, dependencies, responsibilities, deliverables, and acceptance criteria.
When will we hear about a serious issue?
Material findings and unsafe conditions are escalated through the agreed route as soon as they are sufficiently supported. They do not wait for the final report.
Can you help us remediate?
Yes. Remediation and engineering support can be included or scoped separately. The role is disclosed so any later assurance conclusion is appropriately separated and limited.
How is sensitive evidence protected?
Collection is minimized. Access, transfer, storage, retention, deletion, and any client restrictions are agreed before evidence is handled.
What does independent mean?
The conclusion uses agreed criteria, objective evidence, explicit limitations, and disclosed conflicts. It does not imitate a certification, statutory audit, legal opinion, or regulated attestation.
What if the evidence is insufficient?
We say so. The result identifies the unsupported claim, missing evidence, effect on confidence, and the work needed to reach a defensible conclusion.