Skip to content

Methodology

Findings on Tuesday, not a PDF in six months

Every service, from vCISO leadership to technical assessment, is delivered as sprints inside your engineering cycle.

In short

Agile security delivery breaks security work into sprints aligned to the client’s engineering cadence, with a visible backlog, findings reported as they are confirmed, and scope reassessed each sprint. It replaces the waterfall consulting model, in which scope is fixed on day one and a report arrives at the end.

How we deliver

You get findings on Tuesday, not a PDF in six months.

Security consulting has a default shape: scope it in January, disappear, deliver a document in June that is out of date on arrival. Cloudgap runs the same work as sprints inside your engineering cycle, in your channels, with priorities reset every sprint against what the business actually needs next.

Traditional waterfall security consulting compared with Cloudgap's agile delivery model
Waterfall consultingCloudgap
FeedbackA report at the end of the engagementFindings daily and weekly, inside the sprint
ScopeFixed on day one, resistant to changeReassessed every sprint against business priority
PositionAdvisers working in isolationEmbedded in your teams, your channels, your standups
OutputA document describing the problemRemediation shipped, then evidenced
The full methodology

An illustrative first week of an ISO 42001 readiness engagement. Real engagements are scoped to your estate, and the board is yours to see for the whole programme.

In the channel

You see the work as it happens, not at the end

This is the shape of a real first week. Findings land the day they are confirmed, decisions are recorded where they are made, and the artefacts are handed over as they are finished.

Engagement channel · week one

Live

MON 09:12 vCISO: Kickoff. Scope fixed to the product estate, not the whole company. MON 14:40 SEC ENG: Discovery sweep started across SSO, expense and egress. TUE 10:05 SEC ENG: Shadow AI surfaced in three teams. Added to the inventory. TUE 16:22 vCISO: MFA gap on two admin accounts closed. Evidence logged. WED 09:30 ARCHITECT: ISO 42001 gap analysis delivered as a backlog, not a report. WED 15:48 CLIENT: Approved the acceptable use standard for internal circulation. THU 11:15 vCISO: DPIA drafted for the triage model. Sent to the client DPO. THU 17:02 SEC ENG: Asset and model inventory handed over. Client owns it now. FRI 10:00 vCISO: Sprint review. Next sprint re-scoped against the audit date.

Writing

The three pillars

What makes it agile rather than merely fast

  1. 01

    Iterative delivery

    Work is broken into sprints with a visible backlog. You see what is being worked on, what is finished and what is next, continuously - not at a review meeting a month later.

    Sprint length is matched to your engineering cadence rather than ours, because a security sprint that lands out of phase with your release cycle just creates queueing.

  2. 02

    Embedded collaboration

    We work inside your channels and your standups. The alternative - reviewing from outside and posting over a document - is the model this practice exists to replace.

    Practically this means your engineers can ask a question and get an answer the same day, which removes most of the friction that makes security feel like a blocker.

  3. 03

    Adaptive scope

    Priorities are reassessed each sprint against what the business needs next. A finding that mattered in January can be overtaken by a deal that closed in February.

    The counterpart is that deferrals are explicit and recorded, with a named owner. Adaptive scope without recorded deferral is just drift.

FAQ

How the engagement works

What does agile security delivery actually mean in practice?

Security work is broken into sprints aligned to your engineering cadence, with a visible backlog and findings reported as they are confirmed rather than collected into a report. Scope is reviewed each sprint. The consultant works inside your channels rather than reporting in from outside. The practical difference is that remediation starts in week two rather than after a document arrives in month six.

How is this different from just having a consultant on site?

Presence is not the distinction - accountability and cadence are. An agile engagement has a defined backlog with owners, a review rhythm, explicit re-prioritisation, and a named person accountable for the outcome rather than for the days delivered. A consultant on site with no backlog and no cadence produces the same report, more expensively.

Does this work for a certification programme with a fixed deadline?

It works better, because a fixed external deadline makes sequencing decisions unavoidable rather than optional. Scope is narrowed early to what is achievable, the evidence clock starts immediately, and the longest-lead items - supplier assessments especially - get started first. The failure mode in a waterfall certification programme is discovering in month four that the evidence period cannot be compressed.

How do you report to a board on an agile engagement?

Quarterly, on position rather than activity: what the risk posture is, what moved since last time, what is being accepted and by whom, and what decision is being asked for. Sprint-level detail belongs in the working forum. A board that receives a sprint burndown is receiving the wrong artefact.

Start

Three ways in, depending on how close the deadline is.

Or just email a human: hello@cloudgap.ai

We reply within24 hours