Security as a system

A security function that works as a system

Corporate, economic, physical and information security, run as one function with a direct line to the CEO and a regular report to the owner. We start with an audit of about a month, then build the function step by step with COS, our operations methodology.

Cybersecurity · Information security · Economic security · Physical security · Counterparty checks · Personnel

Book an intro call See the six directions

The problem

Why security needs a system, not a guard

Most losses come not from an outside attack but from gaps between processes: between purchasing and payment, between access and dismissal, between a document and the fact.

Fragmented functions
Guards, IT, legal and finance each protect their own area. The risk lives at the joins.
Reaction instead of prevention
Incidents get investigated, but their causes stay in place.
Security without data
Decisions rest on trust, not on verified facts.
Cyberattacks and fraud
Phishing, swapped bank details, hijacked accounts, ransomware.
The human factor
Conflicts of interest, collusion with suppliers, leaks through employees and contractors.

Our approach: security is a managed function, with a mandate, roles, procedures, metrics and a monthly report to the owner.

How we build it

First the process and the owner, then the technology

01
Standardize
Set the mandate and the perimeter, name an owner for every critical process, agree the rules.
02
Document
Write every procedure in DESCRIPTION-5: trigger → inputs → steps → output → errors.
03
Automate
Put technical controls, monitoring and analytics on top of procedures that already work.
04
Optimize
Measure losses, recoveries and costs. Review the risks and improve what already runs.

Technical protection works only where the process, the owner and the rules are already defined.

How COS works →

Six directions

Six directions, one system

One function covers all six, so a risk that crosses departments still has a single owner. Take the full set, or start with the direction that hurts most.

Cybersecurity

The business is prepared to keep working through an attack, with a tested way to restore its data.

What we put in place · 8Show

An inventory of systems, devices, administrators and contractors with access.
Named accounts, multi-factor authentication and separate admin accounts.
Endpoint and server protection (EDR), encryption and timely updates.
Email protection against phishing, and training phishing campaigns for staff.
Network segmentation: office, production systems, cameras and guest access kept apart.
Isolated backups and a regular restore test.
Monitoring and response: signal → assessment → isolation → recovery → review.
Your choice of model: an in-house specialist, an external expert, or a hybrid with an external security operations center (SOC).

What we put in place

An inventory of systems, devices, administrators and contractors with access.
Named accounts, multi-factor authentication and separate admin accounts.
Endpoint and server protection (EDR), encryption and timely updates.
Email protection against phishing, and training phishing campaigns for staff.
Network segmentation: office, production systems, cameras and guest access kept apart.
Isolated backups and a regular restore test.
Monitoring and response: signal → assessment → isolation → recovery → review.
Your choice of model: an in-house specialist, an external expert, or a hybrid with an external security operations center (SOC).

Technical security testing and hardening — penetration tests, phishing simulations, cloud and AI security — are delivered with our technology partner LOGITRON AI. LOGITRON AI cybersecurity →

Information security

Information is available only to the people who need it.

What we put in place · 6Show

Data classification: trade secrets, personal data, contracts, financial and HR information.
Role-based access, reviewed on a schedule and revoked on dismissal.
A trade-secret regime, with NDAs for employees and contractors.
Personal data handled as the law requires, including GDPR where it applies.
Leak prevention (DLP), introduced once data is classified and its owners are named.
Monitoring for leaks and fakes; rules for working with information and AI tools.

What we put in place

Data classification: trade secrets, personal data, contracts, financial and HR information.
Role-based access, reviewed on a schedule and revoked on dismissal.
A trade-secret regime, with NDAs for employees and contractors.
Personal data handled as the law requires, including GDPR where it applies.
Leak prevention (DLP), introduced once data is classified and its owners are named.
Monitoring for leaks and fakes; rules for working with information and AI tools.

Economic security

Money and assets move by the rules.

What we put in place · 6Show

Procurement: offers compared, affiliation and collusion detected, volumes confirmed independently.
Sales and payments: limits, advances and deferrals, with two approvers for critical operations.
Bank-detail fraud: any change of account details confirmed through a channel known in advance.
Variance analytics: accounting, warehouse, logistics and primary records reconciled.
Corporate rights and property: a register of rights, change control and a response plan for corporate raiding.
Anti-fraud work and investigations that separate normal losses from unexplained discrepancies.

What we put in place

Procurement: offers compared, affiliation and collusion detected, volumes confirmed independently.
Sales and payments: limits, advances and deferrals, with two approvers for critical operations.
Bank-detail fraud: any change of account details confirmed through a channel known in advance.
Variance analytics: accounting, warehouse, logistics and primary records reconciled.
Corporate rights and property: a register of rights, change control and a response plan for corporate raiding.
Anti-fraud work and investigations that separate normal losses from unexplained discrepancies.

Physical security

People, sites and property are protected, and the cost of guarding is justified.

What we put in place · 6Show

Site surveys: access, perimeter, lighting and response time.
Guard posts and headcount calculated; in-house and contracted guarding compared.
Guarding companies' licences checked, and the quality of their work controlled.
Access control at critical points: cash desks, warehouses, fuel and material stores.
Video surveillance, access control, sensors and backup power, piloted on one critical site first.
Security for executives and key staff when they travel, and for everyone in an emergency: shelters, alerts, evacuation and safe routes, together with civil protection.

What we put in place

Site surveys: access, perimeter, lighting and response time.
Guard posts and headcount calculated; in-house and contracted guarding compared.
Guarding companies' licences checked, and the quality of their work controlled.
Access control at critical points: cash desks, warehouses, fuel and material stores.
Video surveillance, access control, sensors and backup power, piloted on one critical site first.
Security for executives and key staff when they travel, and for everyone in an emergency: shelters, alerts, evacuation and safe routes, together with civil protection.

Separation principle: guards never accept goods and confirm their quantity at the same time.

Counterparty checks

No advance payment without a check, and no needless refusals.

What we put in place · 6Show

Basic, for every new counterparty: registration, authority, owners, sanctions, bank details, tax and court signals.
In-depth, for large advances, deferrals, intermediaries, complex structures and critical contractors: the ultimate beneficial owner, financial strength, real capacity and links to your employees.
Repeat, when the owner, director or bank account changes, new sanctions appear, the limit grows or an incident happens.
Four verdicts: acceptable · acceptable with conditions · postpone · unacceptable.
Instead of a refusal: staged payment, a smaller advance, collateral or a pilot volume.
One counterparty card, with sources and a review date.

What we put in place

Basic, for every new counterparty: registration, authority, owners, sanctions, bank details, tax and court signals.
In-depth, for large advances, deferrals, intermediaries, complex structures and critical contractors: the ultimate beneficial owner, financial strength, real capacity and links to your employees.
Repeat, when the owner, director or bank account changes, new sanctions appear, the limit grows or an incident happens.
Four verdicts: acceptable · acceptable with conditions · postpone · unacceptable.
Instead of a refusal: staged payment, a smaller advance, collateral or a pilot volume.
One counterparty card, with sources and a review date.

Personnel and HR risks

Reliable people on the team, and departures without leaks.

What we put in place · 6Show

Pre-employment screening: identity, experience, references and links to counterparties.
Screening depth set by role, with stricter checks for access to money, data and warehouses.
Conflicts of interest: declarations checked against procurement data.
Hiring and dismissal run together with HR and IT: access, company property, an exit interview.
Bus factor: critical knowledge and access never sit with one person.
A confidential reporting channel, and protection for the people who use it.

What we put in place

Pre-employment screening: identity, experience, references and links to counterparties.
Screening depth set by role, with stricter checks for access to money, data and warehouses.
Conflicts of interest: declarations checked against procurement data.
Hiring and dismissal run together with HR and IT: access, company property, an exit interview.
Bus factor: critical knowledge and access never sit with one person.
A confidential reporting channel, and protection for the people who use it.

Every check is done within the law and with the candidate's consent.

One example

An agroholding: what we would build

The situation. Several companies across regions, elevators and warehouses, a large machinery fleet, leased farmland and seasonal staff. Security is spread across guards, agronomists, logistics and accounting, and nobody owns the whole risk.

What we would build

A security function with regional specialists at critical sites.
Control of the chain field → weighbridge → elevator → shipment.
Fuel, seed, fertilizer and crop-protection products reconciled against machinery data and crop plans.
Checks of traders, suppliers and carriers, with limits and approvals.
Protection of the land bank and corporate rights, with a response plan for corporate raiding.
A continuity plan for sowing and harvest: power, communications and system failures, and wartime threats, including mine-threat maps before fieldwork.
Seasonal workers: a simple but mandatory admission procedure, with all access revoked after the season.

What it aims for

A traceable path for every tonne, from field to payment
Fewer unexplained losses of grain, fuel and inputs
A protected land bank
A season worked through without stoppages

A typical scenario for the industry, not a client case. The risks of your own company are confirmed with evidence during the audit.

Project stages

From an audit to a working security function

1 · Security audit

≈ 1 month

Meetings with your managers, access to data, a review of critical sites and the incident register. We audit procurement, payments, access, IT, HR processes and guarding.

Result: a map of assets and risks with evidence and owners, urgent measures, priorities and a justified model for the security function.

To work from facts, we ask for: the business structure and sites; staff and current security; key flows of money and goods; counterparties and contracts; the digital environment; and the adjacent functions (IT, HR, finance and legal).

2
Architecture — mandate, structure, headcount, roles and RACI.
3
Procedures — written in DESCRIPTION-5: trigger → inputs → steps → output → errors.
4
Team — job profiles, hiring, onboarding and training.
5
Pilots — controls on one company or process first, then scaled.
6
Resilience test — incident drills, a restore test and technical security testing.
7
Ongoing support — reporting, risk reviews, cost optimization and a yearly assessment of the effect.

The final make-up of the function, investment in sites and the guarding model are approved after the audit, not before.

Operating principles

Without these conditions, the function becomes a formality

A direct reporting line

To the CEO, with an escalation channel to the owner.

The right to stop an operation

To start a check and temporarily stop a risky operation, by a procedure agreed in advance.

Independent investigations

An investigation never reports to the department under review.

A signal is not a verdict

An analytical signal is a reason to check, not a finding that someone broke the rules.

The result

What the owner gets

A risk map with evidence, owners and priorities.
A security function with a mandate, structure, roles and procedures.
Mandatory checks of new counterparties and of employees in critical roles.
Managed access to systems, and a tested recovery after a failure.
Clear lines of responsibility between security, IT, HR, finance and legal.
A monthly one-page report: losses, recovered funds, savings and measures completed, each on its own line.

An honest measure of the effect. We count confirmed reductions in losses, not payback promises made before the audit. Potential prevented damage is reported separately from actual savings.

Service catalog

Turnkey, or one module at a time

All 10 modules: what's included and the resultShow

Service	What's included	Result
Security and risk audit	Interviews with managers; analysis of processes, access, sites and incidents	A risk map with evidence, owners and priorities
Strategy and mandate	Goals, perimeter and authority; boundaries with IT, HR, finance and legal	An approved security policy and a charter for the function
Structure and roles	Starter, basic and extended models; job profiles; RACI	A clear structure, headcount and areas of responsibility
Procedures	Counterparty checks, investigations, access, incidents, site access	A rulebook that can be followed and checked
Hiring the security team	Search and assessment of the head and the specialists; an onboarding plan	A team with confirmed competencies
Putting controls in place	Pilots, integration with accounting, technical equipment, variance analytics	Controls that work inside real processes
Internal investigations	Method, complex cases, preserving evidence, corrective actions	Causes found and gaps closed
Crisis response	Incident scenarios, manual fallback procedures, drills, wartime risks	A tested plan to keep working through an attack or a failure
Metrics and reporting	KPIs for the function, a risk dashboard, a monthly report to the owner	A measurable effect: losses, recoveries, savings
Support and independent review	Risk reviews, an audit of the security function, mentoring for its head	A function that grows with the business

Service	What's included	Result
Security and risk audit	Interviews with managers; analysis of processes, access, sites and incidents	A risk map with evidence, owners and priorities
Strategy and mandate	Goals, perimeter and authority; boundaries with IT, HR, finance and legal	An approved security policy and a charter for the function
Structure and roles	Starter, basic and extended models; job profiles; RACI	A clear structure, headcount and areas of responsibility
Procedures	Counterparty checks, investigations, access, incidents, site access	A rulebook that can be followed and checked
Hiring the security team	Search and assessment of the head and the specialists; an onboarding plan	A team with confirmed competencies
Putting controls in place	Pilots, integration with accounting, technical equipment, variance analytics	Controls that work inside real processes
Internal investigations	Method, complex cases, preserving evidence, corrective actions	Causes found and gaps closed
Crisis response	Incident scenarios, manual fallback procedures, drills, wartime risks	A tested plan to keep working through an attack or a failure
Metrics and reporting	KPIs for the function, a risk dashboard, a monthly report to the owner	A measurable effect: losses, recoveries, savings
Support and independent review	Risk reviews, an audit of the security function, mentoring for its head	A function that grows with the business

Models of scale

Starter
A compact team that combines functions.
Basic
Separate directions and regional specialists.
Extended
Dedicated analysts, economists and counterparty specialists.

Formats

You can start with one step

First step
Security audit
Diagnostics, a risk map and a recommended model for the function. About a month.
Full cycle
A turnkey security function
From the audit to launch and a resilience test.
Targeted
A single module
Cyber, information, economic or physical security, counterparties or personnel.
For an existing team
Support and review
Risk reviews, an audit of the security function, mentoring for its head.

Not sure where to start? Book an intro call and we will suggest the first step for your company.Book an intro call

Who does the work

Who builds your security function

Partner security team

Leaders with experience in corporate and physical security, internal investigations, audit and crisis management, working with information-security specialists.

Stetska Consulting

A consulting practice in business standardization, HR and operations management, with 100+ clients across 8 countries in fintech, banking, IT, telecom, iGaming and e-commerce. The founder's C-level experience spans mid-sized companies to large distributed organizations. Our own methodology, COS, and a book on business standardization.

Meet the founders →

Technical testing · LOGITRON AI

Led by a senior practitioner with 16+ years in IT and 13+ years leading engineering teams, with a vetted associate network for larger engagements.

All testing runs under written authorization, only on systems you own or are authorized to assess. Out of scope, whatever the framing: weaponized malware or exploit development, command-and-control tooling, and any targeting of third parties who have not consented.

Where we work

Ukraine · Kazakhstan · UAE · Poland

For companies in other countries, we adapt the regulatory base to local requirements.

Official sources

Checks rely on official sources: national CERT guidance, state registers, sanctions lists, and the law on personal data and security services. In Ukraine, these are CERT-UA, the NSDC sanctions register, the Unified State Register and the State Tax Service.

Your contact

Khristina Stetska

Email: stetska.khristina@gmail.com
Phone: +38 066 570 00 18
Telegram: @stetska

Start with the audit.

In about a month you see a real map of your company's risks, and a plan for building the security function.

Book a 30-minute intro call

A security function that works as a system

Why security needs a system, not a guard

Fragmented functions

Reaction instead of prevention

Security without data

Cyberattacks and fraud

The human factor

First the process and the owner, then the technology

Standardize

Document

Automate

Optimize

Six directions, one system

Cybersecurity

Information security

Economic security

Physical security

Counterparty checks

Personnel and HR risks

An agroholding: what we would build

What we would build

From an audit to a working security function

1 · Security audit

Without these conditions, the function becomes a formality

A direct reporting line

The right to stop an operation

Independent investigations

A signal is not a verdict

What the owner gets

Turnkey, or one module at a time

Models of scale

Starter

Basic

Extended

You can start with one step

Security audit

A turnkey security function

A single module

Support and review

Who builds your security function

Where we work

Official sources

Your contact

Start with the audit.