Security Discovery Engagement
A structured discovery methodology that turns vague verbal answers into owned, evidence-backed findings.
Nothing raised in discovery gets quietly dropped from the final report.
Project Overview
Security discovery calls routinely surface real concerns that never make it into the final report, because there's no structured way to track a verbal answer through to a documented, evidence-backed finding. KPThink built a phased discovery playbook for this engagement: every open question is logged against a specific area, tagged by criticality, assigned to a named owner and respondent, and, critically, paired with concrete, step-by-step instructions for how to actually go collect the supporting evidence (a screenshot, an export, a written confirmation), rather than leaving "please provide documentation" as a vague, easy-to-ignore ask. Gaps are explicitly categorized as fully missed deliverables, areas never raised at all, or answers that were too shallow to stand behind, so the client's team always knows exactly what's still owed and why it matters, not just that something is incomplete.
Client name, sector, and any technical or personnel details specific to this engagement have been withheld to protect confidentiality. Only KPThink's discovery methodology, not any client-specific finding, is described here.
Client Requirements
- 1A way to make sure verbal concerns raised mid-call don't silently disappear from the written report.
- 2Clear ownership: who on the client's team is actually responsible for answering each open item.
- 3Evidence requests specific enough that a non-security person can actually fulfill them without guessing.
- 4A way to distinguish 'never asked about this' from 'asked, but the answer wasn't solid enough to rely on.'
Discovery Workflow
Illustrative recreation of the methodology described above, not a screenshot from the engagement, and no client-specific question or finding shown.
Services We Provided
The scope of work KPThink delivered for Security Discovery Engagement.
IT Security Discovery & Gap Analysis
Structured Evidence Collection Design
Criticality-Based Findings Tracking
Client-Facing Review Documentation
Key Features & Functionality
The main components of the solution and what each one does.
Severity-Tagged Question Tracking
Every open item is categorized as a missed deliverable, an area never raised at all, or an answer too shallow to rely on, so the client's team sees exactly what kind of gap they're closing, not just an undifferentiated to-do list.
Named Ownership Per Item
Each question is assigned to a specific respondent and role, so accountability for closing a gap doesn't get lost between the discovery call and the final report.
Step-by-Step Evidence Instructions
Instead of a generic 'please provide documentation' request, each item includes concrete instructions for exactly what to export, screenshot, or confirm in writing.
What Changed for the Client
The practical results of the engagement, as documented in the project records.
Nothing Raised Gets Lost
Concerns mentioned verbally during discovery are logged as trackable items with an owner, instead of depending on someone remembering to follow up later.
Faster, More Complete Client Responses
Concrete, per-question evidence instructions mean the client's team spends less time guessing what's actually being asked for and more time actually producing it.
A Defensible Audit Trail
The distinction between 'never assessed,' 'assessed but shallow,' and 'confirmed' gives both KPThink and the client a clear, honest record of what the final report can and can't vouch for.
Challenges & Engineering Solutions
The main problems the engagement had to solve, and how KPThink addressed each one.
The Challenge:
Discovery calls surface real concerns verbally, but without a structured tracking mechanism those concerns routinely fail to make it into the documented findings.
KPThink's Solution:
Built a living question log where every item raised, whether from the call or found independently, gets a permanent, trackable record tied to a specific report section.
The Challenge:
Generic evidence requests ('please provide relevant documentation') produce incomplete or irrelevant responses because the client's team doesn't know exactly what's being asked for.
KPThink's Solution:
Paired every open question with specific, step-by-step evidence-collection instructions tailored to that exact item, so the request is unambiguous even for a non-specialist.
Have a Similar Challenge?
Tell us what you are working on, and we will tell you how we would approach it and whether we are the right fit.