Loss exceedance curve (LEC)
Source. Pattern from FAIR / Cyber Doppler quantification engagements (TEF DSI, Sixt Risk P&L). Real curve shape — characteristic log-log decreasing slope with mid-range knee. AUD amounts illustrative.
The Security Mosaic is the proof. It’s the flagship build that takes every Imagine If on the home page and turns it into something real, working, deployable. Each prompt becomes a tile. Each tile is wired to your tools, your data, your team. Together they form a complete intelligence picture your leadership has never seen before.
It connects your existing security stack (CrowdStrike, Tenable, Wiz, Okta, Splunk and more) and produces a board-ready intelligence picture in 48 hours. Real risk. Real exposure. Quantified in AUD. Compliance evidence mapped to Essential Eight, CPS 234, SOCI.
Every tile is proven. Every tile is yours. The Mosaic is the starting point — not the destination.
One orchestration layer in the middle does the assembly.
The Security Mosaic. Built. Running. Proven.
Disconnected sources on one side. Structured, accountable, audit-ready outputs on the other. The Decision Atlas in the middle does the work.
Six categories of evidence on the left. Three top decisions ranked by confidence and impact in the middle. Four board-ready output packs on the right.
Drawn from the FAIR / Cyber Doppler quantification work, TEF v7 board exhibits, the TEF Master Tracker, and in-house security maturity assessment. Numbers anonymised. See all eight on the proof page →
Source. Pattern from FAIR / Cyber Doppler quantification engagements (TEF DSI, Sixt Risk P&L). Real curve shape — characteristic log-log decreasing slope with mid-range knee. AUD amounts illustrative.
Source. Pattern from TEF v7 'Path to Green' board exhibit. Real category structure — inherent risk → existing controls → planned controls → residual. Values anonymised.
Source. Pattern from TEF Master Tracker. Real composite-scoring structure (DSI 6.4 = weighted sum of coverage / effectiveness / maturity / operations / risk reduction). Component values illustrative.
Source. Pattern from in-house security maturity assessment (4-level model across 12 domains). Real domain set used in CISO advisory. Current vs target band. Scores illustrative.
We do not run POCs. POC is theatre — a word vendors use to dress up a free trial for procurement. We build a working prototype on your data in 48 hours. If the output is not board-ready, you owe us nothing. You keep the report either way.
Our 48-hour prototype uses your actual data from day one. No synthetic demos. No vendor theatre. You see what your environment actually looks like — then decide.
See the hour-by-hour walk-through →Client names on request, under NDA
The Mosaic is the starting point, not the destination. It’s the proof we can do this for you — whatever ‘this’ turns out to be.
Start the conversation →