Meet your named cyber expert accountable for measurable resilience improvement.
Most managed security providers report activity. NormCyber’s Focal Analyst model is different.
Every customer is assigned a dedicated senior security engineer responsible for reducing their exposure, coordinating prioritised action, and demonstrating cyber resilience improvement over time.
Cyber security has an
accountability problem
More dashboards. More alerts. More noise.
But no clear answer to three critical questions:
- Where is our risk increasing?
- What should we do next?
- Who is accountable for turning technical effort into measurable business outcomes?
That is the gap the Focal Analyst closes.
One named expert. Continuous momentum.
Your Focal Analyst is a senior security engineer accountable for driving continuous progress in your cyber resilience.
- Analyse your environment to identify what is driving cyber exposure
- Cut through noise to prioritise the actions that will reduce risk fastest
- Make clear, evidence-based recommendations on what to do next
- Challenge assumptions and bring an external, expert perspective
- Align stakeholders around a focused, achievable plan
- Provide clear visibility of progress through the Smartbloc Portal
- Translate technical activity into commercially meaningful risk reduction
Built for performance, not activity
Most managed services optimise for tickets closed and alerts handled.
The Focal Analyst model is built around a different question:
Is your cyber resilience actually improving?
From day one, we quantify the factors that determine resilience across:
This is distilled into your Cyber Resilience Score, a single, government-grade metric built on the NCSC Cyber Assessment Framework.
From there, every action is expected to deliver measurable uplift.
1. Establish your baseline
A quantified view of current resilience, grounded in live data and expert validation.
2. Monthly performance cycle
Clear reporting on score movement, risks, and priority actions.
3. Analyst-led working session
Focused reviews to challenge, align, and decide what happens next.
4. Coordinated delivery
Actions driven across teams, with ownership and visibility.
5. Continuous adjustment
Your roadmap evolves with live threats, regulation, and real-world change.
From visibility
to momentum
This model turns cyber security into a performance discipline.
Customers gain:
- A named expert accountable for outcomes
- A clear path to measurable improvement
- Stronger prioritisation across competing risks
- Better coordination across teams
- Credible, board-level reporting
- Increased confidence from auditors and insurers
This is not just visibility. It is ownership, momentum, and proof.
Art Fund
2,000+ unknown vulnerabilities identified and reduced by 50% within six months.
Flamingo Group
Practical, proactive improvements delivered across complex global operations.
Clanmil Housing
60% vulnerability reduction in month one, 100% phishing training compliance in six months, and three weeks of manual effort saved per quarter.
Give the board a clear answer on cyber risk
Cyber activity is not the same as cyber progress. Boards need to know whether resilience is strengthening, what is driving movement, and whether security investment is producing measurable return.
The Focal Analyst provides that clarity. By converting technical telemetry into commercially meaningful decisions, they help leadership:
- Make defensible investment choices
- Demonstrate progress to auditors and insurers
- Align security effort to business continuity and risk reduction
- Replace fragmented updates with credible, evidence-backed reporting
See how a Focal Analyst would improve resilience across your environment
Book a consultationFAQs
What is a Focal Analyst, in practical terms?
A Focal Analyst is your named senior security engineer, accountable for improving your cyber resilience over time. They identify where risk is increasing, prioritise what to fix, coordinate delivery across teams, and track measurable progress through your Cyber Resilience Score.
How is this different from a traditional managed security service?
Most managed services optimise for activity. The Focal Analyst model is built around measurable cyber resilience improvements. Your Focal Analyst drives a structured improvement plan, with every action linked to measurable risk reduction.
Will this replace our internal security team?
No. It makes them more effective.
Your Focal Analyst works alongside your internal teams, helping them prioritise effort, align to risk, and focus on what will reduce exposure fastest.
What if we already have multiple security providers?
That is exactly where the model adds the most value. The Focal Analyst provides a single point of accountability across your entire environment, aligning internal teams, external providers, and NormCyber services into one prioritised plan.
How is cyber resilience actually measured?
Through your Cyber Resilience Score. This is a quantified, framework-aligned metric built on the NCSC Cyber Assessment Framework. It reflects the combined effectiveness of controls, exposures, dependencies, and real-world risk across your estate.
It provides a clear baseline and tracks improvement over time.
How quickly will we see results?
Most customers see measurable improvement within the first few months.
On average we see 100% improvement in Cyber Resilience Score within 12 months and 26% annual uplift thereafter.
Early gains typically come from prioritising and resolving high-impact exposures that were previously unaddressed.
What does the engagement actually look like month to month?
You move through a structured performance cycle:
- Monthly reporting on risks, actions, and score movement
- A working session led by your Focal Analyst
- Agreed actions with clear ownership
- Progress tracked transparently in the Smartbloc Portal
This creates continuous momentum, not periodic review.
Who are the Focal Analysts?
They are experienced team of security engineers, supported by NormCyber’s wider SOC, CSIRT, ethical hacking, and data protection teams.
How does this support board-level decision making?
The Focal Analyst turns complex security activity and industry jargon into clear, business-relevant insight that any stakeholder can understand. It gives leadership a direct view of whether organisational resilience is improving or declining, backed by measurable evidence.
The result is confident reporting to auditors, insurers, and regulators, and a clear understanding of return on security investment.
What happens if our risk increases?
Risk movement is expected and visible.
When your Cyber Resilience Score drops or new risks emerge, your Focal Analyst identifies the cause, reprioritises the plan, and drives corrective action quickly.
The model is designed to adapt in real time, not wait for annual reviews.
Is this only relevant for large enterprises?
No. It is relevant for any organisation that needs to demonstrate measurable improvement in cyber resilience.
The model scales across sectors and complexity, but the principle remains the same: clear accountability, prioritised action, and measurable outcomes.
“We meet monthly, which is invaluable both in terms of understanding our cyber risk exposure and where to systematically allocate our time. The Focal Analyst model keeps us accountable and helps us systematically improve our defences.”
Peter McAndrew
LiveOps Manager | Art Fund
“Before Norm, it was hard to demonstrate the ROI of our efforts to the Board. Now, our Cyber Resilience Score is a clear indicator of our cyber posture. The data is visualised and validated by Norm, and it’s structured in a way that even non-technical executives can understand. The Board’s reception was extremely positive, with our Finance Director remarking on its clarity and simplicity.”
Peter Grimley
Assistant Director of ICT | Clanmil Housing
“During the tender process, Norm far outperformed competitive offerings in both quality and pricing. Looking at commercial benefits alone, outsourcing to Norm cost just one-third of in-house management. And that’s before we consider recruitment and procurement costs. As a result, we estimate that Norm is saving us £235,000 annually.”
Peter Grimley
Assistant Director of ICT | Clanmil Housing
“We’re in constant dialogue with Norm. The continuous flow of information keeps us aligned with best practices and ensures we stay one step ahead of potential threats. I have complete peace of mind knowing that Norm is providing round-the-clock vigilance over Fusion GBS’s operations.”
Jeremy Bowman
Chief Information Security Officer | Fusion Global Business Solutions
“Our Focal Analyst has invested a great deal of time into understanding our different business units’ IT environments, as well as their processes and procedures. This means that – as well as being on-hand to answer any questions we might have – he often comes to us with proactive advice about how we can bolster our strategy.” “
Head of Group IT Security & Compliance
Flamingo Group International
