Engagement 01
Supply Chain Diagnostic
You do not need a new pipeline to know exactly where you would bleed.
The situation
Most assessments begin by asking you to describe your pipeline, then spend a month turning your answers into a diagram you already had. You pay for the education of the assessor, and what comes back is a picture of what you told them.
This starts from the artifacts instead — the workflow files, the manifests, the registries, the identity grants — and models what the pipeline does rather than what it was designed to do. The two are rarely the same, and the difference is usually where the exposure is.
This is you if
- You know the pipeline has gaps but cannot say which one to fix first.
- Every assessment you have been quoted starts with a month of discovery you would be paying to teach someone your estate.
- You need a roadmap your CFO will fund, not one that assumes a budget you do not have.
How it runs
- Week 1
Model the estate as it runs
Read-only access to the repositories, CI configuration, registries and identity provider. Everything you ship is resolved to the components inside it, and the pipeline is reconstructed from its own configuration rather than from a description of it.
- Week 2
Rank by what is reachable
Findings filtered by whether the vulnerable path actually executes and whether a fix exists upstream. CVSS orders nothing here; exploitability and reachability do.
- Week 3
Cost the road out
A phased plan with each phase priced and sequenced, so phase one fits the budget you have rather than the one you would need.
What you are left holding
- Your pipeline modeled in Gantry as it actually runs, not as the diagram says
- Exposures ranked by exploitability and reachability rather than by CVSS
- A phased roadmap costed by phase, with phase one sized to what you can fund this year
- The modeling stays yours: every later engagement starts from it rather than from zero
What we need from you
- Read-only access to the source repositories and CI configuration that build what you ship.
- A list of what you consider production, and who owns each of them.
- Two hours with whoever actually runs the build, rather than with the author of the architecture diagram.
A fixed fee that assumes nothing about access is a guess. This is the list that keeps the price the price.
What this is not
- Not a penetration test. Nothing is exploited and no runtime system is touched.
- Not a tool purchase. The output names capabilities and sequence; which product fills them is a later and separate decision.
- Not a compliance audit, though the modeling is what a later audit would draw on.
What we can already show
The same method we published on our own monorepo: 236 findings to 8, measured rather than estimated.
Why people call about this one
The worst cases had no CVE
Compromised maintainer accounts, OAuth applications, reseller channels and retagged actions produce nothing for a scanner to match. Companies that only scan are discovering what that leaves uncovered.
33 of the 44 supply chain incidents we model had no CVE ever assigned
The shape of it
- Shape
- Two to three weeks, fixed fee
- Usually funded by
- CISO · Engineering
- Often leads to
- Supply Chain Modernization