The starting point
Glasgow’s security team knew their weaknesses better than any outsider could; what they lacked was the instrument to convert that knowledge into sustained budget. University courts fund investment cases, not anxieties, and an inventory of technical findings is not an investment case however accurate it is.
The approach
CyPro’s work was, at its core, an assessment done properly: current posture measured against recognised frameworks, a defensible target state agreed, and the gap expressed as a sequenced programme with costs and owners. The findings were then written twice, once for practitioners and once for the people holding the money, because a report the board cannot read is a report that changes nothing.
The outcome
The court approved multi-year, multi-million pound investment and the register entries became funded workstreams. It is the same conviction that shapes every assessment report we produce, tenant-sized or university-sized: findings ranked by what they mean for the organisation, written for the audience that decides, ending in a roadmap someone can actually fund.
