FEDERICA BERTONIAI Risk · Cyber Intelligence · Digital Evidence Review
ANALYSIS

STRATEGIC CYBER INTELLIGENCE · DECISION INTEGRITY

Decisions under uncertainty

Recognize weak signals, assess dependencies, and prepare timely decisions. Analytical advisory services for boards, businesses, and regulated organizations.

Build readiness before an emergency narrows your options

High-stakes decisions often arise while information is still fragmented. A supplier offers reassurance without defining the scope of a problem; a series of anomalies crosses organizational boundaries; a hostile campaign targets technology used throughout the supply chain. Waiting for a complete account can narrow the available options.

Readiness requires clarity about what to verify, who has decision authority, and which capabilities can actually be activated. The practice examines these questions through Strategic Cyber Threat Intelligence, cyber geopolitical analysis, and Decision Integrity, connecting external developments to internal responsibilities.

When a signal warrants attention

A weak signal is an early, ambiguous, or scattered observation that may indicate a meaningful change. It is neither a confirmed indicator of compromise nor proof of a future crisis. These examples show how to turn it into a focused inquiry.

Identity and access

Observation
Unexpected MFA requests or unusual changes in a supplier’s access activity.
Verification
Check authorized activity, scheduled changes, and available logs.
Decision to prepare
Consider additional controls or temporary restrictions with the service owner.

Supply chain exposure

Observation
New campaigns targeting shared technology or credible information about exposed credentials.
Verification
Establish relevance, currency, and whether the dependency is actually present.
Decision to prepare
Prioritize checks according to the exposed process and the time required to protect it.

Continuity and suppliers

Observation
Recurring disruptions accompanied by incomplete information about affected functions.
Verification
Trace the operational impact, shared dependencies, and capacity of the alternative.
Decision to prepare
Prepare the alternative operating path and the conditions for returning to normal.

AI authority

Observation
New permissions or unexpected tool use by an agent within a sensitive process.
Verification
Compare its mandate, authorizations, and action records.
Decision to prepare
Define approvals, limits, and suspension conditions before expanding autonomy.

From evidence to an intervention threshold

Each assessment separates source reliability, confidence in the judgment, and the probability of an event. Repeated reporting of the same claim does not provide independent corroboration. Competing explanations, routine causes, and contrary observations remain part of the analysis; timing alone does not establish causation.

Decision thresholds depend on the process’s criticality, the time required to intervene, and the cost of acting prematurely compared with the cost of delay. When the data cannot support robust estimates, scenarios and consequences are compared without assigning artificial precision to the results. Verification work is also prioritized by its ability to change the decision.

The resulting assessment connects each option to an accountable owner, required evidence, and a condition for reassessment. The organization retains decision authority and responsibility for execution.

A priority for regulated organizations

For banks, insurers, infrastructure providers, and essential service operators, analysis becomes valuable when it informs risk management, business continuity, and supplier governance. DORA and NIS2 provide distinct reference points, applied according to the entity’s sector and regulatory scope.

Engagements can produce analytical evidence that supports discussions among executive leadership, the CISO, risk management, compliance, and operational owners. Objectives and deliverables are aligned with the client’s applicable obligations and procedures; an individual assessment does not constitute a compliance certification.

COMMISSIONED ADVISORY

Three ways to begin

A focused need can become a standalone engagement or the starting point for ongoing analytical support.

Exposure and decision assessment

For an urgent decision or a poorly understood dependency

A structured discussion and review of available materials clarify the process to protect, information gaps, and decisions to prepare.

  • Map of priority dependencies
  • Memo on options and assumptions
  • Verification plan with priorities and responsibilities
Request an assessment

Signal monitoring and decision briefs

For a supply chain, sector, or exposure requiring sustained attention

Periodic selection and assessment of relevant signals, with updates explaining what changes for the client and when decisions should be revisited. Reporting frequency and notification criteria are agreed in advance.

  • Signal and source register
  • Briefs on changes in exposure
  • Escalation and reassessment criteria
Discuss ongoing support

Scenarios for boards and committees

For testing coordination and judgment

Design of the analytical component of exercises involving progressive disclosures, competing priorities, and decision points. Facilitation, observation, and debriefing are defined in the engagement.

  • Scenario dossier and successive updates
  • Decision log and observation criteria
  • Debrief materials and improvement priorities
Design a scenario

PARTNERSHIP

Specialist expertise for partner engagements

Consulting firms, law firms, technology providers, and intelligence organizations can incorporate specialist expertise in cyber geopolitics, AI Risk, and decision quality into their own engagements.

Collaboration can cover dossiers, scenarios, independent reviews, or analytical content for platforms and exercises. Scope, responsibilities, confidentiality, and rights to use the materials are agreed before work begins.

Start with the decision you need to prepare

Describe your sector, the function or process involved, the decision to support, and your time horizon. An initial discussion establishes the scope, required materials, and a fee proposal.

federica.bertoni@federicabertoni.com

If no email application opens, copy the address into the email service you use.

You stay in control

Your preferences

The site does not include advertising, browsing analytics, or profiling. You can choose whether to remember your accessibility settings for subsequent pages and visits.

Technical functions

Always necessary

Once you make a choice, the browser stores it for 6 months so it can be respected without displaying the notice on every page. This record contains no personal identifiers and is not sent to the site.

Stores text size, contrast, link underlining, and reduced motion settings on your device. Settings are not sent to the Data Controller or to third parties. Without this option, you can adjust them on the current page.

These settings expire when your choice expires: no later than 6 months. If you reject or disable this option, saved settings are deleted; active settings remain available on the current page.

This choice does not authorize future tools or services. For full details, including any technical security tools used by the hosting provider, read the cookie and preferences policy.