What are we investing in?
Establish how the full system creates value and where identities, agents, data, vendors, infrastructure, and operations create material dependency.
Assurance
Match assurance to the decision.
Resolve one consequential investment decision, protect it as the system changes, or direct capital and attention across a portfolio using one independent standard.
The missing decision layer
See what matters. Choose the investment. Hold the outcome.
Foldspan starts with the business decision, reconstructs the system across functional boundaries, tests which conditions can change the outcome, and turns the result into funded priorities, accountable execution, and evidence leadership can defend.
What can change the outcome?
Identify the abuse, failure, and adversary paths that can alter launch, customer trust, resilience, or the investment case, then show how much confidence the evidence supports.
Where should time and capital go next?
Translate material exposure into funded priorities, named owners, acceptance criteria, proof, exceptions, and explicit risk decisions.
Three ways to invest
Choose the horizon leadership needs.
Sprint resolves one high-consequence decision. Continuous protects the approved investment as conditions change. Portfolio directs attention across authorized companies or systems while preserving the context of each.
Foldspan
Sprint
Ten business days after complete intake.A ten-day basis for funding, launch, redesign, or risk acceptance.
Leadership is preparing to commit capital, engineering capacity, customer trust, or formal risk acceptance, but architecture, security, policy, vendor, and engineering evidence still do not add up to one reliable decision basis.
When to invest
One named AI-enabled system, workflow, launch, or transaction facing a real approval, investment, renewal, or customer deadline where leadership needs an independent view before the commitment is locked in.
What leadership can decide
Decide what can move forward, what must be funded or redesigned, where specialist proof is worth buying, and what residual risk the authorized executive will own.
Scope
The boundary we examine.
- 01
One consequential system or workflow and the material dependencies capable of changing the decision.
- 02
Human, service, agent, model, tool, and vendor identities, including privilege, autonomy, and approval boundaries.
- 03
Data movement, classification, retention, secrets, cryptographic dependencies, applications, cloud, network paths, endpoints, and operational handoffs.
What Foldspan does
The work, in sequence.
- 01
Reconstruct the current architecture, critical path, dependencies, data flows, and trust boundaries from approved evidence and stakeholder knowledge.
- 02
Map identities, permissions, agency, administration paths, vendor access, and the points where human approval is required.
- 03
Trace sensitive data, lineage, retention, cryptographic protections, build and release dependencies, and customer-facing interfaces.
- 04
Challenge material abuse, failure, and adversary scenarios against the architecture and the evidence available.
- 05
Rank exposure by its ability to change the business outcome, then convert material findings into requirements, funding priorities, ownership, acceptance criteria, validation needs, and sequenced action.
What you receive
What the investment leaves behind.
System record
System and AI inventory, current-state architecture, data flows, trust boundaries, critical dependencies, and identity and autonomy map.
Align leadership and delivery teams on what the investment actually depends on.Assurance analysis
Data and cryptography review, material threat model, prioritized risk register, and eight-domain Architecture Assurance Maturity Model view.
Direct capital and executive attention to material exposure and unsupported confidence.Action record
Roadmap, architecture decisions, control patterns, implementation requirements, named owners, and acceptance criteria.
Convert the decision into funded, sequenced execution instead of an unowned findings list.Stakeholder evidence
Cited evidence pack, executive readout, and engineering workshop using one underlying source record.
Reuse one supported account for board, customer, audit, insurer, risk, and engineering conversations.Boundary
Clear about what this is and is not.
- Architecture-assurance opinion only. It is not certification, legal advice, a financial audit, or a full penetration test.
- The ten-business-day period begins after complete intake. Evidence collection begins only after scope, access, handling, retention, and disposal rules are agreed.
- Specialized validation is separately scoped when proof could change a material decision.
Foldspan Continuous protects the Sprint decision as the system and investment conditions change.
See the products inside the engagementFoldspan
Continuous
Quarterly architect review, material-change reassessment, annual full reassessment, and bounded expert escalation.Protect the investment as the system changes.
An approval becomes unreliable when models, providers, permissions, data, interfaces, releases, acquisitions, or incidents change. Repeating full reviews consumes time; ignoring change leaves leadership funding against an obsolete basis.
When to invest
Leadership teams that need to preserve the value of an approved system, keep customer or board evidence current, and shift security or engineering investment only when material change warrants it.
What leadership can decide
Decide whether the existing investment remains supportable, what changed, where funding or validation must shift, and whether risk authority must be revisited.
Scope
The boundary we examine.
- 01
Consequential systems with an agreed baseline, named owners, authorized evidence sources, and documented change triggers.
- 02
Material architecture, provider, identity, data, interface, endpoint, network, release, acquisition, and incident changes.
- 03
Open decisions, exceptions, compensating controls, remediation commitments, implementation evidence, and reassessment triggers.
What Foldspan does
The work, in sequence.
- 01
Maintain the living system and AI inventory, architecture record, critical dependencies, and accountable ownership.
- 02
Review agreed changes and determine which ones create a new exposure, dependency, assumption, or decision boundary.
- 03
Produce change-specific threat, risk, control, and evidence-confidence deltas rather than repeating the entire baseline for every release.
- 04
Track decisions, time-bound exceptions, compensating controls, formal risk acceptance, remediation ownership, and completion evidence.
- 05
Refresh authorized stakeholder views and perform an annual full reassessment against the accumulated record.
What you receive
What the investment leaves behind.
Living system record
Updated architecture, system and AI inventory, ownership, dependencies, and material-change history.
Protect the original decision with a current view of what the investment now depends on.Change assurance
Threat and risk deltas, control-dependency review, evidence freshness, and changed assumptions.
Focus leadership and engineering attention on what the change actually affects.Accountability record
Decisions, exceptions, risk acceptance, remediation status, implementation evidence, retest results, and named owners.
Keep funded work, exceptions, closure evidence, and accepted residual risk visible.Refreshed evidence
Quarterly review record, annual reassessment, and current leadership, engineering, customer, audit, and insurer views.
Provide one current basis for leadership, customer, board, audit, and insurer decisions.Boundary
Clear about what this is and is not.
- Continuous means periodic and change-triggered architecture assurance. It is not a 24-hour SOC, SIEM, MDR, incident-response retainer, or generic vCISO service.
- Collection remains customer-authorized and read-only by default. No customer system is changed autonomously.
- Continuous does not create automatic compliance certification or replace specialist testing when implementation proof is required.
Coverage can expand to additional consequential systems as operating need justifies it.
See the products inside the engagementFoldspan
Portfolio
Scoped to the diligence, integration, or operating-review window while the offer is standardized through repeated delivery.Direct capital and attention across the portfolio.
Diligence and operating evidence arrives in incompatible formats, so leadership cannot compare where exposure, dependency, integration effort, and evidence uncertainty should receive limited capital and attention.
When to invest
Acquisition diligence, post-close integration, portfolio transformation, or multi-system oversight where one executive standard is needed without treating different companies or systems as interchangeable.
What leadership can decide
Prioritize diligence, integration, remediation, and operating attention across entities while preserving the evidence, uncertainty, and accountable authority behind each decision.
Scope
The boundary we examine.
- 01
Named companies or systems, separate authorizations, and one agreed diligence, integration, or operating decision standard.
- 02
Distinct architecture, identity, data, network, vendor, evidence, and ownership context for every entity in scope.
- 03
Shared exposure, concentration risk, integration dependencies, company-specific risks, and material evidence gaps.
What Foldspan does
The work, in sequence.
- 01
Establish a bounded assurance baseline for every authorized company or system without combining evidence or access context.
- 02
Apply one architecture and evidence model so critical dependencies, threats, controls, and confidence can be compared consistently.
- 03
Identify shared exposure, concentration risk, integration dependencies, and risks that remain specific to one company or system.
- 04
Preserve separate evidence confidence, owners, decisions, limitations, and authorization boundaries.
- 05
Prioritize diligence, integration, and operating action in business context and identify where specialist proof could change the decision.
What you receive
What the investment leaves behind.
Entity baselines
A bounded architecture, threat, evidence, and decision record for every company or system reviewed.
Preserve the investment and operating context of each entity before comparison begins.Comparable portfolio view
Consistent views of architecture exposure, evidence confidence, material risk, and accountable ownership.
Compare where leadership attention is warranted without implying that different businesses are interchangeable.Concentration and integration view
Shared dependencies, common failure paths, evidence gaps, concentration risk, and integration constraints.
Direct integration, remediation, and operating investment across shared and entity-specific exposure.Decision package
Prioritized diligence or integration issues, sequenced roadmap, named owners, and reassessment triggers.
Sequence diligence, integration, funding, and operating decisions with named accountability.Boundary
Clear about what this is and is not.
- Foldspan Portfolio preserves separate entity authorization, access, and evidence context.
- It is not a financial audit, legal opinion, certification, investment opinion, or substitute for complete transaction diligence.
- Specialist testing and implementation work are scoped separately.
Selected companies or systems can move into Foldspan Continuous, and new acquisitions can be assessed against the same evidence model.
See the products inside the engagementUse specialist capacity selectively
Buy proof or delivery reach only when it changes the outcome.
Validation answers one material question when available evidence cannot. Partner delivery extends independent assurance capacity only with clear authorization, quality control, and disclosed responsibilities.
01
Separately scoped
Foldspan Validation
Buy specialist proof only when it can change the decision.
- Problem
- A funding, launch, redesign, or risk decision depends on whether a specific control or implementation actually resists a defined failure or adversary path.
- Work
- Define one explicit validation question and agreed rules of engagement, then use narrow adversarial, implementation, cryptographic, network, wireless, connected-device, satellite, SDN, or specialist testing.
- Output
- Decision-grade test evidence, limitations, remediation requirements, and retest criteria tied back to the assurance record.
- Boundary
- Validation is not automatically a full penetration test. Scope expands only when the decision and rules of engagement require it.
02
Design-partner delivery
Foldspan Partner
Extend delivery without diluting assurance.
- Problem
- MSPs, MSSPs, and vCISOs need to broaden strategic assurance capacity without losing customer authorization, evidence context, independent judgment, or expert review.
- Work
- Use guided intake, standardized workflows, reusable control and architecture patterns, co-branded evidence, central expert review, and customer-controlled access.
- Output
- A disclosed delivery model with independent quality review, customer-specific evidence, portable decision records, and clear responsibilities.
- Boundary
- Broad delivery requires tenant isolation, auditability, support ownership, and separate customer authorization. No standing administrative access is assumed.
Confidential by design
Choose the right investment horizon.
Start with the business decision, accountable owner, outcome at stake, and date due. Sensitive evidence is not required for the first conversation.
Discuss a SolutionPlease do not send sensitive system details. A protected channel will be established before technical discovery.