# ProactiveRISK — Proactive Risk, Inc. > Veteran-led, SDVOSB-certified cybersecurity firm headquartered in Denville, New Jersey. Serving businesses, government agencies, law enforcement, and military organizations across the United States and internationally since 2001. **Tagline:** Veteran-Owned. Human-Led. AI-Enhanced. ANTICIPATE. DEFEND. PREVAIL. **Website:** https://proactiverisk.com **Primary contact:** help@proactiverisk.com --- ## Who We Are Proactive Risk, Inc. (doing business as ProactiveRISK) is a Service-Disabled Veteran-Owned Small Business (SDVOSB) cybersecurity firm. Our team brings military-grade operational discipline, real adversarial experience, and independent advisory perspective to every engagement. We are practitioners first — and an authorized Microsoft CSP reseller (ID# 4612525) for clients who need Microsoft 365 licensing through a trusted security partner. **Founder:** Tom Brennan — Cybersecurity executive. Former OWASP Foundation Board Member; Former U.S. Regulatory Affairs, CREST International; Past Technical Director, SAFECode; Co‑Founder, NonprofitCyber.org; Author on cybersecurity and risk governance; Advisor to NYU, NJIT, CCM, and HPU. Tom brings 20+ years of adversarial operations, governance, and risk leadership to every engagement. --- ## Services ### CyberAdvisor™ — Virtual Chief Information Security Officer Fractional security leadership for organizations that need executive-level cybersecurity governance without a full-time hire. Services include: strategic roadmaps, board-level risk briefings, regulatory gap assessments, security program development, team mentorship, and incident response readiness. Flexible engagement models: advisory, embedded, or interim. ### 24/7 MDR — Managed Detection & Response Round-the-clock security operations center (SOC) monitoring, human-led threat hunting, and integrated Microsoft Defender containment. US-based analysts. 24/7/365 coverage. Rapid containment and escalation. ### CATSCAN® — Comprehensive Assessment of Threats, Systems, Controls, and Networks ProactiveRISK's proprietary adversarial operations penetration testing methodology. USPTO registered trademark. A 7-phase framework modeled on nation-state and APT tactics: (I) Information Gathering, (II) Planning & Weaponization, (III) Attack & Penetration, (IV) Privilege Escalation, (V) Installation, (VI) Command & Control, (VII) Actions on Objective. Engagement types available: - External Network Penetration Testing - Internal Network Penetration Testing - Web Application Testing (OWASP-aligned) - Microsoft 365 / Entra / Azure Assessment - Social Engineering & Phishing Simulation - Mobile Application Testing (OWASP MASVS) - Wireless Network Testing - Hardware / Device Testing Pricing is effort-based and scoped per engagement. See: https://proactiverisk.com/catscan-scope ### TPRM — Third-Party Risk Management Managed vendor risk programs powered by SecurityScorecard MAX. Continuous monitoring of the entire vendor supply chain, AI-driven risk prioritization, remediation coordination, and executive reporting. Designed for organizations with complex or highly regulated vendor ecosystems. ### MEASURERISK — Governance, Risk & Compliance Comprehensive GRC services including: - Framework Audit (CIS, NIST, SOC 2, PCI, NYDFS 500, WQAA, EPA, ISO 27001) - Threat Modeling (attacker-perspective risk analysis) - Tabletop Exercises (TTX) — full-day offsite and on-site globally - AI Risk & Governance — exposure assessment, policy development, regulatory readiness - OT/Industrial Controls Security (F.I.R.E. approach: Fusion, Integration, Response, Enforcement) — ICS/SCADA, water utilities, manufacturing, energy ### ManageIT — Proactive IT & Microsoft 365 End-to-end managed IT services: network monitoring, endpoint management, Microsoft 365 administration, helpdesk support, backup management, and consolidated monthly billing (labor billed separately from licenses). ### Cybersecurity Grant Assistance End-to-end support for federal and state cybersecurity grant programs including: CISA/SLCGP, NSF SaTC, DoD SBIR/STTR, FCC Cyber Pilot, DOE CESER, and WIOA workforce training funding. --- ## Credentials & Certifications - **SDVOSB** — Service-Disabled Veteran-Owned Small Business (federally certified) - **NJ SBE** — Small Business Enterprise, State of New Jersey - **NJ State Contract Holder** — Contract 24-T3121-PRI01 - **CREST Affiliated** — Global Penetration Testing Standards - **OWASP Contributor** — Application Security Standards - **CATSCAN®** — Registered Trademark (USPTO) - **International Association of Chiefs of Police** — Member - **General Liability, Cyber, & Workers' Compensation** — Insured - **Delaware & New Jersey** — Certificates of Good Standing --- ## Industries Served - Financial services and fintech - Healthcare and life sciences - State and local government - Law enforcement and public safety - Legal and professional services - Critical infrastructure (water, energy, manufacturing) - Defense contractors and military adjacent - Education and nonprofits --- ## Why Choose ProactiveRISK - Veteran-led team — military-grade operational discipline applied to cybersecurity - Independent advisor — not tied to any single vendor or reseller relationship - CATSCAN® — proprietary adversarial methodology that tests defenses the way real attackers operate - 24/7/365 US-based SOC monitoring and human-led response - Preferred partner for New Jersey government and law enforcement agencies - SDVOSB certification — eligible for federal and state set-aside contracts - International presence — engagements in Europe, Middle East, and North America --- ## Key Pages - Homepage: https://proactiverisk.com/ - About: https://proactiverisk.com/about - CATSCAN Methodology: https://proactiverisk.com/catscan - CATSCAN Scope Your Engagement: https://proactiverisk.com/catscan-scope - CyberAdvisor™ One-Pager: https://proactiverisk.com/cyberadvisor-onepager - Capability Statement: https://proactiverisk.com/capability-statement - Events & Press: https://proactiverisk.com/events --- ## Contact - **Email:** help@proactiverisk.com - **Client Portal:** https://proactiverisk.com (legacy domain, client portal and billing) - **Location:** Denville, New Jersey, USA - **Service Area:** Nationwide (US) and international