Security Risk Advisors makes security show its work

At a nonprofit medical center, a small administrative chore had become a part-time job. Someone had to check expiring application keys, work out which applications still mattered, and find their owners. According to Security Risk Advisors’ CTO Mike Pinch, it consumed 20 staff hours a week. When SRA mapped the work and applied its SCALR AI platform, it discovered something peculiar: 70% of the flagged applications were no longer being used.

The interesting part is the sequence. First understand the work. Then decide what deserves automation. That habit helps explain a company whose offerings stretch from simulated attacks to round-the-clock defense.

Give the defenders the answer key

In SRA’s purple-team exercises, the attackers announce their moves. A facilitator guides the session. Red-team operators execute adversary techniques; blue-team analysts watch their defensive systems and record the logging, alerts and blocks. Everybody can see the experiment. The point is to improve the defense while the people who understand each side are together.

It is an appealingly practical arrangement. A penetration test looks for vulnerabilities and risky configurations. An open-book exercise examines defensive visibility. A company can have useful answers to the first question and uncomfortable answers to the second.

VECTR supplies the shared notebook. Test cases record attack techniques and defensive outcomes. Its features include MITRE ATT&CK coverage maps, comparisons across environments and historical results. An engineering change can therefore face a specific examination: does the next execution produce a different outcome?

The distinction matters when choosing a service. Because a purple-team exercise is announced, its result cannot establish how an organization would handle a covert intrusion. SRA also offers red-team assessments, which examine that separate problem.

A score you can return to

The harder question comes after the test: how does this performance compare? SRA uses shared Threat Simulation Index plans and peer benchmarks to give security leaders a reference point. Health-ISAC describes an annually agreed healthcare test plan, drawn from relevant attack techniques, with organizations engaging once, twice or four times a year.

That cadence changes the assignment. A report becomes a baseline for another rehearsal. Detection content and engineering recommendations become things a team can implement and test again. The comparison is useful precisely because it concerns observed behavior under a defined test.

SRA’s 2026 Purple Perspective report draws on more than 160 Index executions conducted during 2025. That is a substantial collection of rehearsals, though it remains a view through SRA’s engagements rather than a census of corporate security.

The rehearsal has a night shift

Security Risk Advisors also handles the work between exercises. Its SCALR XDR offering combines 24/7 monitoring with threat hunting and security engineering. The architecture uses a security data lake to store and search events while managing the amount of data sent into expensive analytics systems. Microsoft Sentinel and Defender are central technologies in its Microsoft partnership.

The broader service menu includes application testing, cloud security, operational technology, strategy and compliance. Its market position sits between a specialist consultancy and a managed security operator, with proprietary software connecting the two. Buyers can engage people to test controls, engineer improvements or help run the defense.

Those buyers include enterprise security leaders and healthcare organizations. There is also a named humanitarian relationship: SRA provides SCALR XDR CyberSOC service to the International Rescue Committee at no cost. Cribl contributed enterprise software and support, and SRA says the IRC onboarded data within days.

Free software. Real operating costs.

Giving away tools is a recurring choice. VECTR has a free Community edition alongside commercial enterprise offerings. In August 2026, SRA announced a free SCALR AI platform for deployment inside a customer’s private Azure tenant. The license costs $0. Customers pay their Azure compute costs.

Implementation still requires work. SRA offers assistance with training, customization and co-sourced operations. Its business combines paid consulting, engineering and managed services with software that teams can use. Free access reduces one purchasing obstacle; it does not make the people or infrastructure disappear.

Tim Wainwright and Chris Salerno founded the firm in 2010. In October 2025, Recognize announced its first institutional equity investment, with the founders continuing to lead. Terms were undisclosed. The announcement described more than 300 cybersecurity professionals operating in the United States, Ireland and Australia.

The service business also makes training a production issue. SRA’s careers material describes internal development, company-paid external training, and co-op and internship opportunities. Its stated values include “Level Up” and “It’s Personal.” For buyers, the practical question is whether knowledge survives the engagement. A shared test record and side-by-side work give the client’s analysts something they can revisit after the consultants leave. The approach depends on participation: an organization needs people available to observe the exercise, understand the findings and carry the repairs into daily operations.

The meeting before the model

There is a constraint running beneath the AI offering. In September 2026, SRA’s Jared Anthony described how inconsistent field names, mismatched identities and uneven retention windows can undermine automated investigations. An agent cannot reliably connect evidence that the underlying systems cannot reconcile. His prescription starts with the data architecture.

Pinch’s October account adds the human preparation. The medical center’s key-review job became suitable for automation after the team mapped its steps: identify approaching expirations, check usage, then involve the owner. The discovery about unused applications came from asking what the workflow actually needed to accomplish.

“The conversation worth having is what to focus on before the first agent gets built.”

Mike Pinch / SRA CTO / October 2026

The transferable method is modest enough to try: choose a repeated task, describe its steps, establish a baseline and inspect the result. For defensive testing, bring the people who attack and the people who investigate into the same exercise. Record the gap. Repair it. Give the next rehearsal a date.