Capabilities
Across every layer of security.
Security fails between systems more often than within them. These capability areas are described separately because they are staffed and scoped separately — but they are designed to be delivered as one architecture.
Engaged today
Advisory and program work.
Protocol engages this work on a per-client basis following an initial conversation. It is delivered by people and process rather than by a product that has not shipped.
Cybersecurity
Assessment, architecture, protection, identity, cloud security, incident preparedness, resilience, and managed security.
Cybersecurity is treated here as one layer of a security architecture rather than a separate discipline. The same principal, organization, staff, and premises appear on both sides of the digital line, and the decisions that reduce exposure usually cross it.
Explore CybersecurityHow work is scoped
What happens after a first conversation.
Capability areas are how the work is staffed. They are not how it is sold — no engagement begins with a category, and none begins with a purchase.
- Defined scope first
- Work begins with an assessment of a stated scope rather than with a retainer. The scope names the properties, entities, people, and systems being examined, and says what is excluded.
- A written description
- The first thing produced is a description of the environment as it actually is — what exists, what protects it, who is accountable. Most programs have never had this written down in one place.
- Architecture before procurement
- Interfaces and boundaries are specified before anything is bought, so vendors are selected against a specification rather than a feature list.
- Named owners
- Every boundary between two systems gets a named accountable party, decided while nobody is under pressure. "The vendor" is not a named party.
- Ongoing or not
- Whether the program needs continuous oversight is a design decision, made explicitly. It is not assumed in either direction.
The boundary
Protocol holds no government contract awards, no contract vehicles, no personnel or facility clearances, no manufacturing or export-control licenses, and no third-party certifications. It has no delivered engagements to reference. Everything above describes how work is scoped, not work already performed — the disclosures state this in full.
One architecture
These areas are described separately because they are staffed and scoped separately. They are designed to be delivered as a single architecture, because that is where security programs actually fail.
Most programs begin with a defined-scope assessment rather than a purchase.
Under development
Strategic and future capability.
These areas are stated directions rather than delivered work. Each page says so in the sentence, not only in a badge.
A note on naming
Two things share one word.
Intelligence under Capabilities is the service — threat monitoring, research, and analysis delivered to a client. Protocol Intelligence is the publication, where Protocol writes in the open. They are related but they are not the same thing.
Start with an assessment.
Most programs begin the same way: a structured review of what is being protected, what is currently in place, and where responsibility actually sits.