Client stories

What the packs did in the room

These notes name the work that was commissioned and the constraint that mattered. They are not scores.

The first draft made our Easter logging pause look like a calm fortnight. We sent the change calendar back and the shaded band went in. The committee finally stopped congratulating us for a week we had not been counting.

Helena Crowe, Head of security, regional NHS trust — Incident trend briefing

We had three clocks in the ticket thread and a chat export that started an hour late. The timeline kept the conflict visible instead of picking a favourite. The after-action chair used it to stop us relitigating the order of the first four detections.

Marcus Adeyemi, Incident commander, rail operator — Single-incident visual reconstruction

I asked for figures that would sit next to the rest of the paper without looking like a different printer had been used. They matched our margins. I still wanted a shorter caveat note; the second pass trimmed it without dropping the incomplete-feed sentence, which I needed.

Priya Nair, Risk committee secretary, insurer — Board pack charting

The day was useful, though we spent longer than I expected arguing about whether informational events belonged on the same axis. We left with a written rule, which is more than we had on the Monday.

Owen Blake, SOC supervisor, university — On-site charting clinic

Longer accounts

Four sites, one quarter, one pack

The engagement began with a kickoff in which we listed every collector and admitted that Plant 3 had a fortnight of missing endpoint events after a vendor change. Rather than average that plant into a group line, the briefing kept it on its own row and captioned the gap. The walkthrough was remote; plant leads joined from the shop-floor offices. The useful argument was not about colour. It was about whether a supplier’s incident at the gatehouse belonged in the same window as the endpoint events. We kept it on a separate figure. I still use that split when someone asks for a single number for the quarter.

Francesca Holt, CISO, manufacturing group — Incident trend briefing

A committee that reads paper

The authority’s risk committee sits in a room with a single projector and a habit of circulating paper overnight. Previous security pages had been screen captures with unreadably small rule names. Contenttrailcore redrew the quarter as three figures and a caveat list, then sent a greyscale proof. One figure still crowded the legend; they opened the type on the revision. I presented without them in the room. Nobody asked me to zoom in, which had become the usual opening question.

David Kerr, Operations director, local authority — Board pack charting