The Fidelis Method
For the security officer who carries the counterintelligence mission alone, and for the agency, company, or research institution with no program of its own.
Fidelis builds the program and the policy, delivers the written products a full counterintelligence section would produce, trains and tests the people who run it, and stays on when the role needs someone to call. The work follows one sequence of four products, each engaged on its own and each answering a single question.
Understand
Threat Estimate
Who could harm us, and how?
Map
Risk & Vulnerability Assessment
Where are we exposed?
Reduce
Risk & Vulnerability Mitigation Strategy
What do we do first?
Sustain
Evaluation & Training Plan
Does it work, and can we keep it working?
↺ Results feed back: a new threat returns to step 1, a changed exposure to step 2, a measure that failed to step 3.
Each product is a separate engagement with its own scope, deliverable, and agreement; the sequence is the order in which they build on one another.
What Fidelis Delivers, and Its Role at Each Step
1 · Understand
Fidelis delivers
▸ The Threat Estimate: who would target you, what they want, and how they operate, drawn from publicly available sources and from your internal information under handling terms agreed in writing
▸ An executive threat briefing
Fidelis's role
Analyst and advisor. Frames what must be protected and the decision at stake, then judges which threats are credible.
2 · Map
Fidelis delivers
▸ The Risk & Vulnerability Assessment
▸ The Risk Awareness Architecture Assessment (RA3): whether threat information reaches the right decision-maker in time to act. RA3 is not a maturity assessment or a program evaluation; it follows real reports along the path they actually travel, from first observation to final decision.
Fidelis's role
Independent assessor. Interviews, records review, and tracing of real reports, measured against what should be true.
3 · Reduce
Fidelis delivers
▸ The Risk & Vulnerability Mitigation Strategy
▸ Implementation support while your teams put it in place
Fidelis's role
Strategist, then advisor through implementation. Fidelis stays engaged to resolve issues and adjust the plan; your people and providers do the work.
4 · Sustain
Fidelis delivers
▸ Evaluation: tabletop and red team exercises that test whether the measures hold, authorized in writing with stop conditions
▸ Training: hands-on instruction for individuals and teams, built around your specific problem and threat
Fidelis's role
Evaluator and trainer. Tests the protection, prepares the people who carry it, and returns findings to the step that owns them.
Where Every Offering Fits
1 · Understand
2 · Map
3 · Reduce
4 · Sustain
Each bar spans the steps that offering covers. Outlined bars apply across the whole sequence.
1 · Understand
- Executive Framing Session
- Focused Threat and Exposure Assessment
- Technology Protection and Emerging-Technology Risk
- Targeted-Threat and Executive-Risk Resilience
2 · Map
- Focused Threat and Exposure Assessment
- Risk Awareness Architecture Assessment (RA3)
- Insider Risk and Sensitive-Information Protection
- Vendor, Supply Chain, and Third-Party Risk
- Technology Protection
- Targeted-Threat Resilience
3 · Reduce
- Implementation Support
- Insider Risk
- Third-Party Risk
- Technology Protection
- Targeted-Threat Resilience
- Federal: Baseline Counterintelligence Program and Policy Development
4 · Sustain
- Tabletop and Red Team Exercises (authorized in writing)
- Individual and Team Training
- Federal program development
Across every step
- Independent Analytical Review
- Retained Advisory
- CISANDRA
Ways to Begin
Executive Framing Session
Defines what must be protected and the decision you face; ends with a short written brief on the right next step.
Focused Threat and Exposure Assessment
Who is targeting one program, technology, relationship, or concern, and how it is exposed; evidence-supported findings and prioritized options.
Risk Awareness Architecture Assessment (RA3)
Whether threat information reaches the right decision-maker in time to act, where it stalls, and what to fix first. Not a maturity assessment: it follows the path information actually travels.
Independent Analytical Review
A second opinion on an existing assessment, threat judgment, or program, for general counsel, audit committees, and boards.
Retained Advisory
One to two principal days a month for standing counsel between engagements.
Program and Policy Development
For small and one-person offices, and for organizations starting from nothing: the program charter, policies, reporting procedures, and training plan, fitted to the office that will run it.