But I want all the shiny things... How to align offensive security with your Maturity and threat models

Organisations often struggle to identify which offensive security services provide the best return on investment for their unique circumstances. This talk introduces a pragmatic framework for selecting offensive security services based on organisational maturity and relevant threat models. Drawing from real-world implementation experiences, we'll demonstrate how security leaders can optimise their offensive security programs to maximise risk reduction while avoiding costly mismatches between security services and organisational readiness.

In the ever-evolving cybersecurity landscape, organisations face increasing pressure to implement robust offensive security programs. However, without proper alignment to organisational maturity and threat models, these investments can lead to wasted resources, overwhelming findings that cannot be practically addressed, or a false sense of security.

This talk provides security leaders and practitioners with a practical framework for selecting offensive security services that match their organisation's security maturity level and threat landscape. Rather than defaulting to the most advanced or trending services, we'll demonstrate how a thoughtful, staged approach yields superior security outcomes and more efficient resource allocation.

The presentation will begin by exploring methods for assessing security maturity, leveraging industry standards like ASD Essential Eight and NIST frameworks. We'll then discuss pragmatic approaches to threat modelling, introducing accessible methodologies like Adam Shostack's "Fast, Cheap + Good" approach that organisations can implement regardless of their current maturity level.

With this foundation established, we'll introduce a comprehensive mapping of offensive security services against organisational maturity levels.

Through case studies and practical examples, we'll demonstrate the real-world application of this framework, showing how organisations can:

The talk will conclude with guidance on implementing a holistic testing program that evolves alongside organisational maturity, incorporating feedback loops between offensive findings and defensive improvements.

Attendees will leave with practical tools for assessing their current state, selecting appropriate offensive security services, and building a roadmap that matures their offensive security program in tandem with their overall security posture.