Every UAE CISO we have engaged with has a security dashboard. Some have several. What is rarely present when the board asks 'are we at acceptable risk?' is the specific answer — the specific MFA coverage percentage, the specific privileged accounts without governance, the specific logging blind spots, the specific vulnerability aging trend. Dashboards report activity; boards ask about posture. The two rarely converge without deliberate work between them.
The instinct is to buy another dashboard or commission another pen test. The instinct treats different symptoms. What produces a defensible board answer is baselining the controls that matter most — identity, privileged access, logging coverage, vulnerability hygiene, incident response readiness — against measurable KPIs, and translating the baseline into a 90-day control plan that closes the highest-impact gaps in a defined execution window. A4 does that work on a fixed scope in 2 weeks. Not a penetration test. Not a maturity model. The controls that matter most, baselined and prioritised.
Six streams,
ending in the 90-day plan signed.
Security tooling review and control-scope confirmation front-load week 1. KPI baselining, backlog build, and executive readout overlap through week 2. Two phases; six streams tightly sequenced.
Security tooling review
Existing security stack inventoried — SIEM, EDR, IAM, PAM, vulnerability management, IR tooling. Coverage and configuration state assessed against the five control dimensions.
Control-scope confirmation
The five control dimensions (identity, privileged access, logging, vulnerability, IR readiness) scoped to your environment. Cloud posture included where applicable — same scoring frame, cloud-adjacent evidence.
KPI baselining
MFA coverage %, privileged access governance %, log coverage %, vulnerability aging, incident readiness score — measured against your actual environment, not vendor defaults. This is where most engagements do the load-bearing work.
Prioritised control backlog
Every gap with severity rating, remediation recommendation, and named owner. Sequenced by risk-reduction impact against the 90-day window — not by ease of fix.
Logging and evidence checklist
The specific log sources and evidence artefacts the security team must produce for ongoing SOC operations and audit cycles. Where SIEM gaps exist, they surface here — the checklist is executable, not aspirational.
Executive readout & board pack
Direct executive readout with CISO, CIO, and board sponsor. Posture heatmap and 90-day plan in board-defensible format — the document that answers the 'are we at acceptable risk?' question without further work.
Two weeks.
Two phases.
Duration is fixed at 2 weeks. Phase count is fixed at 2 for engagements this compact. Milestones are signed gates — not aspirations. This is the tightest AssessSKU engagement pattern; scope discipline is what makes it fit.
The baseline,
run on measured KPIs not vendor defaults.
Every A4 engagement follows a fixed methodology tuned to your environment in the first two days. Not a pen test. Not a maturity model interview. The sequence that produces a defensible posture baseline and a 90-day control plan in 2 weeks.
From dashboard confidence
to board-defensible posture.
A typical pre-engagement state has multiple security dashboards, activity metrics reported weekly, and no specific answer to the 'are we at acceptable risk?' board question. The engagement produces the posture baseline and 90-day plan the CISO can defend at the next board review without further work.
Reference pattern. Some engagements produce a posture heatmap where the honest output is 'you are in better shape than the dashboard suggested — the specific gaps are these three narrow classes.' That's a legitimate deliverable, not a failure. The alternative is manufacturing findings that would justify a larger backlog than the environment warrants — which produces remediation work the security team does not respect.
A UAE bank,
privileged accounts baselined.
Representative pattern for a UAE financial institution facing audit and board-review pressure — MFA adoption uncertain, privileged account sprawl unmeasured, logging gaps assumed non-critical. Ranges reflect target outcomes NexITC underwrites in scope for this class of engagement. N=1 — illustrative composite, not a specific client.
Four artifacts,
each with signed acceptance.
Every deliverable has documented acceptance criteria signed at engagement kickoff. Nothing more, nothing less.
Posture Heatmap
Five-dimension heatmap — identity, privileged access, logging, vulnerability, IR readiness — with specific KPIs measured against your actual environment (not vendor defaults). The visualisation the CISO uses with the board.
Control Backlog
Every gap with severity rating, remediation recommendation, and named owner. Sequenced by risk-reduction impact against the 90-day window — not by ease of fix.
Logging & Evidence Checklist
The specific log sources and evidence artefacts the security team must produce for ongoing SOC operations and audit cycles. Executable, not aspirational.
Executive Readout & 90-Day Zero-Trust Plan
Direct executive readout with CISO, CIO, and board sponsor — posture heatmap and 90-day control plan in board-defensible format. The document that answers the 'are we at acceptable risk?' question with specific evidence, and the delivery vehicle that turns the readout into signed execution rather than another shelf-ware plan. Sequenced by risk-reduction impact so the first 30 days close the highest-priority gaps, not the easiest.
Six outcome metrics,
measured pre and post.
Success is not "the assessment happened." It is measured against six specific outcomes captured at engagement start and re-measured at the executive readout and 30-day post-handover check-in.
Honest scoping.
A4 is a fit when specific conditions are met. It is not a fit when other conditions are — and "you need attack-surface validation, not posture baseline" is a legitimate not-a-fit answer we surface before scoping.
Signs off scope, KPI baseline, and 90-day control plan. Typically 30% time commitment through the 2-week engagement.
Read-only access to SIEM, IAM, PAM, vulnerability management, and EDR consoles. Access negotiation post-kickoff extends timeline; sort it up front.
The board sponsor accountable for security posture at board level. Readout without the accountable sponsor produces reports that get filed rather than acted on.
Prior audit reports, tooling dashboards, and incident logs from the last 12 months. A4 baselines against your actual environment; historical context accelerates Phase 1.
Backlog appetite agreed at commitment level (not exact figure). Without appetite, even signed backlogs become unfunded — filed, not delivered.
That's a penetration test — different engagement class. For AI-specific adversarial validation, A9 AI Safety & Red-Teaming Sprint™ covers LLM and agent attack surfaces. A4 baselines control posture; pen tests exploit attack surfaces.
That's A10 Cyber Insurance Readiness Pack™ — insurer-ready security evidence for premium optimisation. Different evidence set, different buyer (CFO/risk manager alongside CISO), different framework (Federal Decree-Law No. 34 + underwriting standards). Sometimes sequenced A4 → A10 when both drivers apply.
That's B9 Zero-Trust Core Build™ — fixed-scope Cybersecurity build for the highest-priority zero-trust controls. A4 defines the plan; B9 executes. Sequence: A4 → B9 when the plan needs to be defined first; B9 directly when the plan is already signed.
That's B10 SOC Integration Build™ for structured SIEM/SOC gap-closure execution. A4 surfaces logging gaps and produces the checklist; B10 implements against it.
Fixed fee.
Milestone-based. No surprises.
Every A-tier engagement is scoped and priced upfront against defined deliverables. Milestones tied to signed gates. Change orders negotiated through the Practice Lead, not surfaced as invoice surprises.
Five, most asked.
Q_01Is this a penetration test?
No. A4 is a control posture and evidence readiness assessment — not attack-surface exploitation.
Penetration testing is a different discipline that validates whether attackers can breach specific attack surfaces; A4 measures whether the underlying controls are in place, governed, and operational.
The two are complementary but scope separately. Organisations often run both across an annual cycle — A4 for posture baseline and 90-day plan, penetration testing for adversarial validation of specific attack surfaces.
Q_02What does the posture heatmap actually assess?
Q_03Can this include cloud security posture?
Q_04How does this differ from A10 Cyber Insurance Readiness Pack?
Q_05What comes after A4?
One name.
Six accountabilities.
Specialist consulting means the person who scopes the work is the person who delivers it — with escalation to CEO on any material issue within 24 hours.
Practice Lead — Cybersecurity
Present at every phase gate, every scope decision, every difficult conversation. Available for 30/60/90-day post-handover check-ins as part of the engagement.
Including scope amendments.
Signs off all 4 deliverables.
With executive sponsor.
Authorised to negotiate.
CEO within 24 hours.
30/60/90-day check-ins.
Peer. Next.
Zero-Trust Core Build™
The natural build engagement after A4. Executes the 90-day plan for zero-trust identity and privileged access controls — scope, KPIs, and named owners carry over from A4's backlog as direct scope input.
SOC Integration Build™
Alternative or complementary next engagement — closes SIEM/SOC gaps A4 surfaced in the logging and evidence checklist. Sensible when logging coverage is the primary gap rather than identity/access controls.
SecOpsCommand™
The natural run engagement after the 90-day sprint completes — continuous security operations, monitoring, and IR. A4 baselines the posture; B9/B10 execute the plan; C7 sustains posture through ongoing operations.
30 minutes.
One posture question.
Bring the specific posture question blocking your board conversation — MFA coverage uncertainty, privileged account sprawl, SIEM gaps, IR readiness. A4 is scoped in the clinic — control-stack access, sponsor, timeline, prerequisites. If A4 is not the fit (pen test needed, insurance-cycle driver dominant, controls already known-and-missing), the clinic surfaces the honest alternative.
- —Security tool access confirmation
- —Cloud posture scope check
- —Board sponsor availability
- —Fit assessment against A10, B9, B10