State actors
Industrial espionage and strategic disruption.
Request a briefingAdversarial Risk Management
Your adversaries are smarter than your risk framework.
Traditional risk management asks what could go wrong. Adversarial Risk Management asks who wants it to go wrong, and what they will do next.
45+ years operational and advisory experienceCritical infrastructure, major-project and international engagementsContributor to ISO Technical Committees TC 292 and TC 262CSyP · CPP · PSP · CRISC
01
The threat has changed
Risk methods built for hazards struggle with intelligent opponents.
Traditional risk management was not designed for intelligent opponents. It was built to manage hazards: events that occur without intent, adaptation or regard for your defences.
Deliberate adversaries are different. They observe your controls, select their targets and change their methods when you change yours.
RiskAdviza exists to close that gap, with a methodology built for adversaries who think, not hazards that don’t.
02
Who is targeting you
Intent changes the risk.
Threat actors do not share the same motive, tolerance, capability or route to access. Treating them as a generic risk category conceals the decisions that matter.
State-aligned proxies
Deniable operations on a state’s behalf.
Organised crime
Extortion, fraud and industrialised ransomware.
Insiders
Negligent and malicious, recruited and self-motivated.
Activists
Reputational and operational pressure.
Commercial competitors
Intelligence collection through legitimate-looking access.
03
A familiar pattern
The problem is rarely one security control.
Security investment without threat prioritisation.
Physical and digital security functions that do not speak to each other.
Attack pathways nobody has mapped.
Supplier dependencies nobody has tested.
A board that cannot say, with confidence, who wants to harm the organisation and how.
Understand the ARM methodology →Five Operational Fronts
One adversarial picture. No organisational silos.
Adversaries do not respect the boundary between cyber, physical, personnel and supply-chain security. RiskAdviza combines indicators across all five Operational Fronts to expose attack pathways no single security function can see on its own.
Cyber
Digital access, systems, identity and operational technology.
Physical
Sites, assets, access, surveillance and protective security.
Personnel
Insider exposure, coercion, recruitment and trusted access.
Supply Chain
Vendors, contractors, logistics and concentrated dependencies.
Information
Intelligence, narrative, sensitive data and decision advantage.
From diagnosis to judgement on call
Five distinct ways to engage.
The entry point is the Adversarial Threat Assessment. From there, engagements move from assessed threat to strategy, testing, executive readiness and retained senior judgement.
View the full service architecture →Principal-led by design
Senior judgement, not junior consulting leverage.
RiskAdviza is led by Bruce Braes CSyP, CPP, PSP, CRISC, with more than four decades of operational, consulting and leadership experience across military intelligence, law enforcement and international security consulting.
ISO TC 292 & TC 262 contributorMervyn David Lifetime Achievement Award 2024Thinkers360 top fifty global security thought leader
Why clients work directly with the principal →Mapping Exposure Beyond the Perimeter
How an operator replaced a compliance-driven budget with an adversary-led investment roadmap.
Read the anonymised case study →RiskAdviza SITREP
Intelligence for leaders facing deliberate threats.
SITREP remains the subscription and distribution engine. RiskAdviza.com is the permanent home for enduring methodology, evidence and selected analysis.
Speak directly with RiskAdviza
A confidential 30-minute discussion with the principal adviser.
No sales presentation. Discuss current threat concerns, organisational vulnerabilities, existing risk approaches and whether RiskAdviza is the right fit.