Cybersecurity. Law. Technology. Geopolitics.

CyXcel is a next-gen professional advisory business — created to manage crises, solve challenges, and seize opportunities for everyone in the digital world.

thumbnail_CYXCEL.jpg

CYXCEL.jpg

CyXcel

Implementing people, process, and technology solutions to help companies reduce the risk of cyber attack. Providing information and consultancy services to enable companies to be cyber secure.  

Cyber Security

From a cyber security perspective, more often than not, it is a supplier failing that is at the root cause of a cyber security breach.  Supply Chain or Third Party Cyber Risk Management enables visibility on how cyber resilient your suppliers are, where the risks are, and allows you to identify steps to mitigate those risks. 

Third Party risk management is essential for maintaining cyber security resilience.  

Supply Chain Cyber Risk Management

Services to ensure that Internet of Things (IoT) devices are designed securely, provide the appropriate layers of protection to IoT devices, and to test the security of existing IoT devices.

IoT devices exist within the sphere of Operational Technology, or OT, which includes hardware and software used to monitor and control physical devices, processes, and infrastructure within industrial operations

IoT devices, when connected, and working together can be known as Cyber-Physical Systems (CPS).    IoT cyber resilience services include the provision of CPS platforms to manage CPS environments, which are typically outside of conventional corporate enterprise IT environments.



Internet of Things (IoT) cyber resilience, protection, testing, and security 

A single platform or set of services that cover all elements of cyber security, provided by a single vendor.

Unified cyber security can include only cyber tools and technologies provided by that vendor, or can include a range of cyber tools and technologies provided by a number of different vendors, but managed within, interfacing to, and overseen by a single platform.

Unified Cyber Security

Providing the critical online or face to face training that helps staff protect themselves and the company against cyber crime. 

No matter how good your company cyber security technical defences are, your cyber security posture is weak at best, if you do not have Cyber Security Training in place for your staff.

Cyber security training can include face to face, online video training, awareness questionnaires, and attack simulation, including simulated phishing attacks, where employees are tested with regard  to their ability to spot and report phishing attempts.





Cyber Security Training

A system, platform, software product, or service that enables effective management of the lifecycle of corporate contracts, ensures compliance with terms and conditions, manages renewals appropriately, and ensures payment of the right amounts at the right times, for the services contracted for.

With regard to software naming conventions: Contract Lifecycle Management software or CLM software can also referred to as Contract Management Software or a Contract Management System.

Contract Lifecycle Management - CLM

Services and products that provide analysis of individual contracts, and the analysis of the contracts of an entire organisation.

Enabling deep understanding of organisational contract commitments, reducing exposure to risk, increasing efficiency of contract management, and ensuring that payments are aligned with contract terms.

Contract Analytics and AI

Providing technology and / or services to support the new vendor sourcing process: from initial vendor landscape analysis, through to short listing, issuing RFIs (Requests for Information), issuing RFQs and RFPs (Requests for Quotes and Requests for Proposals respectively), going through the vendor and bid evaluation process, through to vendor selection, contract negotiation and signature.

Source to Contract (S2C)

Software platforms, services, and tools to assist with the process of managing contract risk and compliance, increasing efficiency in the process of reviewing and approving contracts.

Using artificial intelligence, natural language processing, and deep learning, KRC tools allow for Key Legal Obligations / KLOs to be specified, and different templates developed for different legal contexts or contract types.

Contract Risk and Compliance - CRC

Penetration testing is the ethical testing of a company's cyber security defences.

Penetration testing can be for a company's entire IT cloud and IT infrastructure, a single application, or for an IoT (Internet of Things) device.
 


A penetration test or "pen test" will emulate the full set of actions that are performed by cyber criminals.  These actions are identified in leading cybersecurity frameworks - and most clearly in the MITRE ATTACK framework.

The objective of a pen test is to report on vulnerabilities that could be exploited, and then report them back to the company, so that the vulnerabilities can be addressed before they are exploited by a cyber attacker.

Penetration testing can be restricted to testing the level of cyber resilience from a technology perspective, or can extend to simulated email phishing tests, where employee cyber awareness and resilience is tested.

Beyond Penetration testing, there is Red Teaming, where a team will test all elements of corporate security defences, including physical security, site access, cyber security, and social engineering elements.  Red Teaming is viewed either as additional to penetration testing, or as an advanced, next level form of penetration test.


Penetration testing

Supplier risk management is the process of knowing, tracking, responding to and mitigating supplier risk. A supplier becomes a risk when its ability to provide key services or products is impacted or fails due to financial issues, geopolitical events, natural disasters, cyber security breaches, capacity issues, or when its reputation is at stake due to failure to comply with sustainability/environmental, social and governance (ESG) requirements.

Supplier Risk Management Services

Providing strategy and consultancy services so that appropriate corporate governance is in place, enterprise risk is managed, and regulations are complied with.

Providing technology platforms that assist with GRC.

GRC - Governance, Risk, and Compliance

Third-Party Risk Management covers the same set of risks as vendor or supplier risk management (financial, capacity, geo-political, natural, compliance and cyber risk) but extends beyond immediate vendors, to track and address failings or risks at any point in a supply chain.

Third Party Risk Management (TPRM)

Delivering platforms, products, or services to identify, manage, and mitigate against insider threats.  Insider threats, also known as insider risks, are when a trusted insider (employee or contractor) who has authorised system access, intentionally or accidentally performs actions that damage a company's ability to operate effectively.

The damage can range from a data breach to causing corporate system shutdowns or system damage to non IT related damage, such as financial crime, violence, or physical damage.



Intentional insider threats can take the form of violence, corporate espionage (e.g. IP / trade secret theft for bad actors / foreign Govts), physical or virtual sabotage, theft. financial crime.

Unintentional insider threats are caused by system users being used by third parties, e.g. via phishing attacks, or credential breaches, to damage and encrypt systems, and steal data.

There is also the coerced insider threat, where a staff member is coerced or blackmailed by a third party. into performing damaging actions.


Insider Threats 

Knowing the current and potential threats that  present the greatest risk to your orgainisation, and proactively ensuring that the right people, process and technology solutions are in place to mitigate against them.

Threat intelligence is information on specific cyber threats to your organisation.  

Threat intelligence moves the goal posts: rather than responding to an attack, threat intelligence enables an attack to be prevented.  This can be anything from breaking up and arresting a cyber criminal group, to identifying the attack vectors and profiles in advance of attack,  then ensuring sufficient protections and mitigations are in place.  

Threat intelligence is gained from large data sources shared between cyber security companies, on global network and dark web activity, and also from honey pots, which are simulations of an actual company network, that then attract the attacks of criminal groups targeting the specific company.

Threat intelligence enables the delivery of ATP / Advanced Threat Protection.

Threat Intelligence

Digital Transformation is the process of transforming a company's business processes alongside selecting, implementing and leveraging best fit technology solutions to enable those processes to deliver increased value, efficiency and profitability.  Also referred to as IT Transformation.

A central element of digital transformation is effective project and programme management.

Working back from required business outcomes, determining the approach, technologies, and partners needed to assist in the realisation of those outcomes.

Effective project and programme management is not just about following a methodology or framework, such as Prince2 or Agile, it is about team leadership, team work, collaboration, and strong relationships.

Core to digital transformation is designing and implementing the correct Enterprise Architecture.  The most common methodology for implementing Enterprise Architecture is TOGAF (The Open Group Architecture Framework).  

Digital Transformation (DX)

Providing services related to the recovery, investigation, and analysis of digital data from networks, computers, and mobile devices for the purposes of providing evidence for a legal team’s defence or prosecution of criminal acts, including cyber related crime.

Digital Forensics

Providing security for your cloud application ecosystem, monitoring and reporting on access to your sensitive personal and commercial data in the cloud, and monitoring data and behaviour between your cloud services, otherwise known as Saas (Software as a Service) 

SaaS Security

Enabling efficiency in corporate procurement: ensuring the selection of best in class service providers that are also the right fit for your business.   Enabling both cost effective service or product procurement on one hand, and ensuring that the services that your company buys in deliver the required competitive advantage. 

Procurement Services

Providing the intelligence, insights, toolsets, and analytics, alongside best practice response preparedness, so that, in the event of a cyber breach, your company will be able to mitigate exposure, minimise business losses, and fast track recovery to normal operations.

Incident Response

Services and solutions enabling detection of and response to cyber security breaches.   

Services include those delivered from a Cyber Security Operations Centre (SOC or CSOC) where a 24/7 team monitors for cyber breaches, and responds in real time when breaches are identified.

Solutions include technologies that firstly monitor for breaches, secondly flag when the occur, and thirdly facilitate remediation or best available response to a breach.

Managed Detection and Response (MDR) is generally the term used for the service, and Extended Detection and Response (XDR) is the term used for products or solutions used in MDR.

XDR is broken down into Network Detection and Response (NDR) - which deals with identifying threats at the network level, along with providing the appropriate response, and Endpoint Detection and Response (EDR), which deals with identifying threats at the endpoint, along with providing the appropriate response.

Managed Detection and Response  - MDR - and Extended Detection and Response - XDR

Integrity, transparency, and accountability are fundamental to our approach. 