Improve
A finding is not progress. A decision with somebody’s name on it is.
Cyber Guys turns assessment gaps and simulation results into prioritised recommendations written the way a business owner reads — and then makes sure an answer is recorded, including when the answer is no.
- Recommendations in business language, not control identifiers
- Urgency, effort, indicative cost and a named owner on every item
- Five ways to respond, all of them recorded
- Declines produce a dated, attributed, immutable risk acceptance
Six recommendations awaiting a decision
- MFA not enforced for all usersApproved
- Backups not recently testedQuote requested
- Shared admin account in useRisk accepted
- No staff cyber awareness trainingApproved
- Supplier bank changes unverifiedDeferred
- No incident response planAwaiting
Every decision is dated, attributed and stored with the exact wording the decision-maker was shown.
How it works
Raise it. Explain it. Capture the answer. Record what was accepted.
- 1
Raise the gap
Findings from an assessment, a simulation or an observation become candidate recommendations in one action, rather than being retyped into an email.
- 2
Write it in business language
A guided builder produces wording a non-technical decision-maker can act on: what it means, why it matters, what happens if it is ignored, what it will take, and who needs to act.
- 3
Capture the answer
Approve, request a quote, ask a question, defer to a date, or decline. Every response is stored with the exact wording that was on screen at the time.
- 4
Record what was accepted
A decline requires a named person to acknowledge the risk. That becomes an immutable, dated record with a review date — not a line in a thread nobody can find.
The real problem
Clients do not ignore cyber advice because they disagree. They ignore it because they did not follow it.
Most cyber recommendations die in an email that used the words “conditional access policy”. Nobody said no. Nobody said yes. And nobody wrote down that the conversation happened.
- The recommendation was technically correct and commercially invisible.
- Nobody could explain what actually happens if it is ignored.
- The decision was never captured, so it was never revisited.
- When something went wrong, there was no record of the advice.
Shared admin account in use
- DecisionDeclined
- Accepted byPractice Manager
- AcknowledgedYes
- Review date6 months
- RecordImmutable
- Wording shown at the timeStored
If the answer is no, that is a legitimate business decision. It just has to be a recorded one.
What is included
Remediation and accountability features.
Recommendation builder
A guided workflow from choosing the organisation through to publishing and notifying. The output is always business-facing English, never a control identifier.
Risk explainer library
20 plain-English explainers covering MFA through to incident response planning. Each has a client version, a manager version, a review talking point and the wording to use if the risk is accepted.
Action portal
The decision-maker’s view of their own plan. Each item answers the same five questions and then offers five ways to respond.
Risk acceptance register
Filter by organisation, category, urgency, review date, accepted, deferred or resolved. Records are never edited — a correction creates a new version and preserves the original.
Responsibility matrix
A plain-English split of what the IT provider owns and what the business owns. The document that prevents most “I thought you were doing that” conversations.
Urgency, effort and cost
Each recommendation carries an urgency, an effort estimate and an indicative cost range, so prioritisation is a business conversation rather than a technical one.
Review dates that come back
Deferred work and accepted risks carry a review date and reappear on it. A deferral is a decision to revisit, not a decision to forget.
Objection handling library
12 objections IT providers actually hear, each with a suggested response, the business reasoning behind it, a follow-up question and a recommended next action.
For IT providers
The decision register, in depth.
Everything above works for a business running it alone. If you are an IT provider running this across a client base — publishing to client portals, handling objections, and turning a quarter of recorded decisions into a review that lands — there is a page for that.
See what a recorded cyber decision actually looks like.
A real action plan, a published recommendation, and the risk acceptance record that comes out the other end.