Cyber Incident Readiness Assessment

How far an attack would get before you stop it.

Where would you land?

How it is done

1. 01 Two to three weeks inside your organization, reading your documents, talking to your people and sitting at your consoles.
2. 02 We take real alerts from the last six months, one in Standard and two in Flagship, and follow what happened, from the moment each fired until it was closed.
3. 03 Each gap gets a rating, a cause, and the name of the person who has to fix it. Then we go through the list with those people.
4. 04 About 90 days later we come back in person to see what has changed.

Five moments this pays for itself.

1. Ahead of a regulator examination or an audit.
2. After an incident at a peer or a competitor.
3. Before renewing an outsourced monitoring or MSSP contract.
4. Before a cyber insurance application or renewal.
5. Before deciding on an incident response retainer with anyone. It is also how Fulk Labs chooses its own retainer clients.

Two tiers. Both complete.

Both tiers include every part the result depends on. The scenario walkthroughs. The review of your detection and response controls. A real alert traced from start to finish. The response readiness review. One root cause and one owner for every gap. The full report, the readout, and the in-person follow-up about ninety days later. Flagship covers five attack scenarios instead of three. It goes deeper into your detection rules and your MSSP's service, traces a second alert, and adds a briefing for your CEO or board. Which tier fits is settled on the call.

Your admin logs in. We change nothing.

The control review happens side by side with a member of your staff who has admin access. They log in. The consultant operates the console under their supervision to check the settings that matter. No accounts are created for us. Nothing is changed, no tools are installed, and no copies of production data leave your environment. Screenshots of settings are kept as evidence. Your staff can end the session at any time.

What lands on your desk.

• Scorecard Every scenario rated for whether it would be seen, detected, and acted on. Your response readiness and your main controls too. Each rating carries the evidence behind it.
• Findings Every gap with its rating, its root cause, and the clause of your framework it affects.
• Fix list In priority order. Each names who does it: your team, your MSSP, or a vendor. The owner and the date are confirmed at the readout. In the report and as a spreadsheet.
• Executive summary Two pages for the CEO or board, with the readiness level and the first fixes to make.
• The Fulk Readiness Level Stamped on the report, with what you must fix to reach the next level. It stands for twelve months. It is an assessed level, not a certification.

It closes the paperwork too.

Every finding is mapped to the framework you are examined on. The report goes to your regulator or auditor as it is.

• Every organization in Oman. Royal Decree 64/2020 and the duty to notify the Cyber Defence Centre.
• Banks, finance and leasing companies, payment service providers, exchange houses. The Central Bank of Oman Cyber Security and Resilience Framework.
• Public joint stock companies, including most insurers. The Information Security Guidelines for Public Joint Stock Companies, Circular E/1/2022.
• Health insurance claims administrators. The Financial Services Authority claims administration regulations.
• Any organization holding personal data. The Personal Data Protection Law and its executive regulations, including the 72-hour breach notification.
• Energy services and industrial contractors. IEC 62443 and the security clauses in your operator's contract.
• ISO/IEC 27001:2022 Annex A, for organizations certified or certifying.

That is useful. It is not the point.

What the assessment does not do.

• It does not fix the gaps. The fix list goes to your team, your MSSP, or your vendors.
• It does not write your plan or playbooks, and it does not run exercises. That is retainer work.
• It is not a full configuration audit, and it does not review every rule and log source.
• It is not penetration testing, red teaming, or attack simulation.
• It is not forensic acquisition, threat hunting, or a compromise assessment. If signs of a live compromise appear, the assessment pauses. You are told immediately.
• It is not legal advice, regulatory sign-off, certification, or attestation.

Find out how, on a call.

Forty-five minutes with the founder. Tell him what you run, who would respond today, and what worries you most. You leave knowing where you stand and what to fix first.

For the person accountable for detection and response.

Organizations that complete the assessment may be offered the Cyber Incident Response Retainer.