How a five day Cyber Resilience Sprint uncovered the gaps hiding in plain sight at a mid sized company

Overview

Certifications and penetration tests show that a company follows its documented controls. They do not show whether those controls work on an ordinary Tuesday.

When a peer of similar size, stack and certifications was hit by ransomware, our client’s CEO asked the board a simple question: “If it happened to them, what’s stopping it from happening to us?”

Sennovate ran a five day Cyber Resilience Sprint built on NIST CSF 2.0 to answer that question with evidence. Within one week, the executive team had a scored maturity baseline, a clear view of four hidden gaps and a 90 day plan the board could approve.

The Scope

The Challenge

Compliant on Paper

The company held ISO/IEC 27001:2022 and ISO 22301 certifications, ran an integrated management system and commissioned annual vulnerability assessments and penetration tests. By every compliance measure, it was doing the right things.

But the CEO’s question was about confidence, not compliance. Nobody in the room could answer it with certainty.

Conformity Is Not Effectiveness

An ISO audit confirms that a management system exists and that a sample of controls is implemented as documented. A VAPT confirms which technical vulnerabilities existed in a scoped environment on the day of testing.

Neither shows whether offboarding really revokes every access, whether the SOC investigates the alerts it receives, or whether the crisis plan holds up during a 2 a.m. phone call.

Attackers Target the Seams

Attackers don’t attack certificates. They attack the seams between tools and people, and between policy and practice.

The company needed to find those seams before an attacker did, and it needed answers in days, not months.

The Solution

Rather than a six month audit, we ran a five day Cyber Resilience Sprint built on NIST CSF 2.0, testing effectiveness across four pillars: Technology, Process, People and Governance.

Key initiatives included:

• Used the client’s existing ISO and VAPT artifacts as inputs, with nothing redocumented and no disruption to operations.
• Ran facilitated sessions with IT, HR, Legal and Operations.
• Replaced “do you have a policy?” with “show us the last time it worked.”
• Required evidence behind every score, not assertion.
• Tested how each control performs day to day, not only whether it exists.
• Scored maturity across every NIST CSF 2.0 function and benchmarked the results.

This evidence first approach turned a compliance question into an honest answer about how security actually works.

Services Delivered

Cyber Resilience Assessment

Evaluated security maturity across all NIST CSF 2.0 functions with evidence based scoring, benchmarked against industry peers.

Identity and Access Review

Assessed human and non human identities, including service accounts, integrations and third party SaaS access, to find credential and offboarding gaps.

Detection and Response Review

Reviewed alert volumes, triage processes and SOC capacity to show where detection worked but investigation did not.

Governance and Crisis Readiness

Tested incident response and executive crisis paths, and delivered a prioritized roadmap with board ready reporting.

Gaps Uncovered

The technology stack was broadly in good shape. The gaps lived elsewhere:

The identity illusion

Human users were protected by MFA, but dozens of service accounts and integrations ran on static credentials with no rotation and no monitoring.

The alert graveyard

Detection tooling generated more alerts than the team could investigate, and medium severity alerts were closed on sight. The tooling would have caught an attacker; the

The offboarding seam

The leaver process was disciplined for internal systems, but access to three third party SaaS platforms sat in a separate manual workflow that was occasionally missed.

The untested 2 a.m. call

A solid incident response plan existed, but the executive crisis path (who decides, who calls legal, who speaks to customers) had never been exercised.

None of these would appear as a nonconformity in a surveillance audit or in a VAPT report. All of them are exactly how breaches like the peer’s actually unfold.

What the Executive Team Received

Within five days, leadership had what no certificate had ever given them.

The result was:

• A scored maturity baseline across all NIST CSF 2.0 functions, backed by evidence and benchmarked.
• A prioritized 90 day action list, sequenced by risk reduction per unit of effort.
• Quick wins the team closed inside the first month.
• A board ready narrative that turned “we think we’re fine” into “we know where we stand, and here’s the plan.”

The Impact

Beyond compliance, the sprint gave leadership confidence grounded in evidence. The company scored Level 3 (Defined) overall, with some functions scoring a level below, and the board now knows exactly where to invest first.

Three lessons apply to any boardroom:

• Conformity is not effectiveness. Ask your team to show the last time a key control actually fired, not the policy behind it.
• The seams are the risk. Offboarding, vendor access and crisis decisions: breaches live in the handoffs between departments.
• Speed is a feature. You don’t need six months to find out where you stand. You need a week, the right questions and the appetite for honest answers.

Key Outcomes

Greater Visibility Across Critical Systems

Modern Open XDR monitoring brought the legacy IBM i environment into a structured security operations framework, improving visibility into suspicious activity.

More Focused Security Investigations

Detection tuning, correlation, and enrichment reduced low-value alerts and manual effort, allowing analysts to focus more effectively on validated security events.

Faster Response with Operational Continuity

Automated response workflows accelerated investigation and containment. Security containment activities caused zero disruption to supply chain operations.

Clearer Oversight for Leadership

A repeatable reporting cadence provided operational teams and executives with consistent insight into security trends, significant events, and service performance.

The organization gained a continuously optimized SOC operating model that supports its round-the-clock logistics environment while improving security visibility and response.