Outwork Security's proposal to watch every laptop, mailbox and sign-in at Ashcombe Dray, around the clock, for three years. We wrote it as the tabletop exercise your Risk Committee would run, so you can decide it the way you'd decide a real incident.
It came from the Risk Committee's September minutes, and it's the test every page of this proposal has to pass.
We can't lose a client file. Not one, not for an hour, not on a weekend.Risk Committee minutes, Ashcombe Dray LLP, September 18, 2026, item 4
a weekday that the firm's 22-person IT team watches for trouble, 8 a.m. to 7 p.m. After that, a pager that rings for outages.
client audit questionnaires this year asked whether the firm is monitored 24 hours a day. Each time the honest answer was partly.
matter folders in the document system with no one reading who opens them after hours.
Five injects, one at a time, the way your committee would get them in the room. Choose what the firm does with the people and tools it has today. Then see the same minute with Outwork on shift.
Exercise figures use Ashcombe Dray's own offices, accounts and folder counts.
The same Friday with Outwork on shift. Scroll to run the clock. The intruder's line stops at minute nineteen.
Fourteen offices, 3,140 laptops and desktops, 2,910 mailboxes and 38 cloud apps, all reporting to one Outwork operations center. Switch a source off to see the blind spot it leaves. Tap an office for its numbers.
Mail and sign-ins go first, for every account at once, because that's where the exercise started. Laptops and servers follow in three waves by region, so no office is ever half covered.
A threat hunt across the firm and a new tabletop with the Risk Committee, written from what we saw that quarter.
A two-page report for Ruth and a one-page version for the committee, in plain words, with every alert we closed.
A renewal review with Martin three months before the term ends, so nothing renews unseen.
Each chapter answers one person's question with a tool they can run themselves, so nobody needs a call to get to yes.
Catherine, Managing Partner
Clients send audit questionnaires before they send matters. Pick a client and see how the firm answers today and with Outwork in place.
Questions drawn from the three questionnaires the firm answered this year.
Desmond, General Counsel
Engagement letters set how fast the firm must tell a client about an incident. Our investigation runs under your direction, so the work stays privileged. Set the deadline and the incident, then see what you'd have in hand.
Hours from the first click. The red line is the client's deadline.
Ruth, CIO
Your team of 22 keeps its daytime work. Outwork takes the hours nobody's watching today. Tap any hour of the week to see who answers and how fast.
Seven days, twenty-four hours.
Martin, CFO
A 24/7 team needs five shifts covered, plus leave. Set the team and salary you'd hire at and compare it with the price as you configure it below.
Salaries carry 30 percent for benefits and taxes. Tools and log storage are $420,000 a year.
The Risk Committee, seven partners
Five risks from the register you review each quarter. Switch between today and the first year with Outwork to see where each one moves.
Likelihood across, impact up, as your register scores them.
Likelihood
The 24/7 watch and onboarding are the same in every version. Everything else is a line you can drop, and each one says what you'd lose.
You're choosing between full sight of every sign-in and matter folder at $3,600,000, and the core watch alone at $2,100,000.
We'd keep sign-ins and the matter folder watch whatever else moves. Sign-ins are the line that catches 4:41 on Friday, and the folder watch is what lets Desmond tell a client exactly what was opened. If the total has to come down, take out the named security lead first. Ruth's team keeps the same analysts through a shared queue.
An Outwork analyst acts on every high-severity alert within ten minutes, every hour of the year. Miss it twice in a quarter and that quarter's fee drops by 15 percent.
If we miss the ten-minute commitment in two quarters of year one, you can leave at the end of that year with 30 days' notice and no fee.
Every log we collect belongs to the firm. U.S. offices are stored in the U.S., London in the U.K. When the contract ends, we hand back 13 months of records in a format your team can open.
During an incident, our investigation is directed by Desmond's office so findings stay privileged. Written reports go to him first.
We don't contact or negotiate with an intruder unless the General Counsel asks in writing. That decision stays with the firm.
Fees are fixed for the term. Adding an office or 200 more accounts is priced at the same per-account rate, in writing, before any work.
Three things we'll settle with Ruth before onboarding starts.
Accepting books the real exercise with your committee and Outwork's analysts in the room in week 12. Pick a date, and each signer initials their line.
Five initials needed.