Evidence a board and an investment committee will both accept

Three moments that matter

Before close

What is the actual security position of this target, what will it cost to fix, and is anything here a reason to reprice or walk?

The first hundred days

A plan with owners, dates and costs. Not a maturity score. Something an operating partner can hold a management team to.

Every quarter after

Comparable reporting across the portfolio, so an outlier is visible without reading twelve different formats.

Why diligence often misses the point

Diligence windows are short and management teams are busy. Most of what matters is observable from public sources without occupying anyone: the estate, the supplier chain, mail and certificate hygiene, breach history. That work can start before management access is granted.

What we do

Pre-close assessment

Passive first, so it can begin immediately, then targeted questions where the public picture raises one. Findings with remediation cost, not a score.

The 100 day plan

Prioritised by risk and by cost to fix, with named owners and dates the operating partner can track.

Portfolio-wide monitoring

The same checks across every portfolio company, so quarterly reporting is comparable and an outlier stands out.

Exit readiness

A buyer will run diligence on you. Being able to hand over a maintained evidence pack shortens that and removes a lever from the negotiation.

Fractional vCISO

For portfolio companies too small for a full-time hire but too exposed for nobody.

What this looks like in practice

The sample report is the monthly format. For portfolio use the same structure carries a company column, so one document covers the estate. The demonstration shows the passive method that makes pre-close work possible before access is granted.