Synthetic voice and synthetic video have made the convincing colleague cheap to manufacture. The defence is not a more suspicious workforce. It is a process in which one convinced person is never sufficient.
Human-risk programmes are usually measured on click rates. Click rate is a proxy for a thing that no longer describes the attack.
Find every workflow where a single individual, under time pressure, can complete an irreversible action. That list is the programme.
A callback to a known number costs ninety seconds. The control fails not because people refuse it but because nobody made it the normal path.
Voice as an authentication factor is now a weak one. Any process still relying on recognising a colleague needs re-examining on that basis alone.
These paths do not start with a file. They start with a request that a competent, busy person had no reason to refuse. Choose an entry point.
Five stages, from the way in to the thing the attacker came for. What changes between paths is how long each stage stays invisible.
Human risk is not solved by training people to be suspicious. It is solved by designing processes where one convinced person is not sufficient.
Four stages, every engagement. Hover a stage to see what happens in it.
Three moves. Two of them are ours, and the one in the middle is deliberately somebody else’s.
Detection engineering, triage, response and the reporting that goes with it. This is an operational service with a named duty owner, not an advisory engagement.
Effectiveness testing of a service Orvix runs is performed by a party that does not report to the team running it. Where a regulator or a board needs the result to carry weight, that party is not Orvix.
Detection gaps found by the test become engineering work with a date against them, and the re-test is run by the tester rather than by us.
Three engagements inside this pillar. Start with the question you can name, or take the whole estate at once.
Detection and response run as a service, with the dwell time written down.
The attacks that arrive as a convincing person rather than as a file.
The estate where availability outranks confidentiality and patching is not free.
Thirty minutes. Name a high-consequence action a single person can complete alone, and we will start there.
Book a 30-minute scoping callORVIX · INDEPENDENT AI & TECHNOLOGY ASSURANCE · WE DISCLOSE EVERY COMMERCIAL RELATIONSHIP ON THE PAGE FOR THE SERVICE IT BELONGS TO. WHERE LICENSING IS REQUIRED, DELIVERY IS PERFORMED BY NAMED PARTNERS UNDER THEIR OWN LICENCE.