Sec Ops Consulting
© 2026 REKKY Consulting LLC
Appearance
Method
A security engagement follows one job, puts a person on it, closes the split, runs it on a real week, and leaves the account with you. Engagements are remote-first across the U.S., and on-site travel is available. We work around your normal operations, and we'll need access to the right areas and the right people while we do.
01
We watch one job move from request to done. The map is the path people use, including the side path the diagram omits.
A map that repeats the policy is not a finding. The finding is the path the work takes when the official one stalls.
02
We put one owner on each duty that can stop that path. Two owners, or none, is the finding.
The name is a person who can change the outcome. Not a committee. Not a tool.
03
We close the seams that matter first. A handoff. Two records of the same person. Shared access. A second week at a second site.
We do not replace the stack unless a record cannot carry the work. Two sites do not get two operations.
04
We run the reviews on a week that is already happening. We record what held, what slipped, and what changed, including SOC 2 and PCI evidence.
If the audit evidence describes a different operation than the floor, the evidence is wrong.
05
We hand over the owners, the reviews, and the record. Your team runs the next week.
We leave. A result that needs us in the room every week is headcount by another name. We do not leave a system that needs us in the meeting.
We do not boil the ocean. An unused diagram is not a result. Once you approve it, we'll need access to the right areas and people.
01
We trace how the job moves, and where people cover a disagreement by hand.
02
We write what already works, what disagrees, and what a hire would only hide.
03
We close the split and return the week. Your people run it.
The five steps above still hold. An incident engagement also has this order. We work around your normal operations, and we'll need access to the right areas and the right people while we do.
01
We write what the engagement will and will not cover before it starts. One incident type, one system, or the Recon Assessment. You can decline the scope. There is no fee for asking. The scope names the people we need in the room and the systems we need to see. If you approve it, those are the access requirements. If they are not available, the date moves. We do not start on a substitute list and call it the same engagement.
02
We read the plan, the playbooks, and the last incident record you actually have. A missing document is a finding, not a delay we hide. A document that names people who have left is also a finding. Where the page and the operators disagree, we write the disagreement.
03
We walk one system the incident would cross, with the person who operates it. Who can change it, who would notice it is down, where the record of a change would go, and whether a restore has ever been completed. Shared logins, departed administrators, and vendors who still have access are written as facts.
04
The tabletop, the restore, or both, as the scope says. The people who would be called attend. We facilitate and we write. A decision with no owner is left visible in the record. We do not score the room. We do not run a surprise production outage.
05
We hand you the plan, the playbook pages that changed, the exercise record, and the restore result if there was one. They stay with the company. The engagement is finished when the people you already have can run the next incident from that record. After we leave, we do not keep a standing login and we do not keep the only copy of the plan.
If the scope is still being argued, we do not start the exercise to keep a date. A tabletop with the wrong people produces a record that looks finished. If the system we were going to walk is down for an unrelated reason, we wait or we pick another system in writing. If you need a forensics firm or a negotiator, we stop and say so.
ISO 27001 readiness and penetration testing use the same account. A finding in one area is a correction in the others. Once you approve the scope, we'll need access to the right areas and people.
Operations without a destination for alerts leaves failures undetected. Security work without sound infrastructure investigates symptoms. A control record without both produces paper without protection.
Penetration testing applies pressure on purpose, so the record shows which controls fail, which signals arrive late, and where ownership is unclear before an incident sets the timeline.
Readiness is configurations, logs, tickets, restoration tests, and retest results. We record what held, what failed, and what changed.
The engagement establishes procedures, ownership, and operating habits. We work around your normal operations, and we'll need access to the right areas and the right people while we do.
01
An on-site or remote review of systems, personnel, and leadership, with a written account of what needs attention. Remote-first across the U.S. On-site travel is available.
02
A sequence to correct, detect, document, and test according to the risk in that account. You can decline it.
03
Execute the plan, test, correct, and retest until the same paths hold. A finding without a retest stays open.
04
A later cycle, if you want one, as the environment changes. It is a separate scope. It is not a standing login we keep after the record is yours.
Contact
Tell us the security or IT operations problem. Engagements are remote-first across the U.S., and on-site travel is available. We work around your normal operations, and we'll need access to the right areas and the right people while we do.