VistaClair questionnaire

Answer every question based on observed reality. This flow has 20 questions and takes about 8 minutes.

How many security initiatives are currently active and consuming meaningful effort?

Given current people, attention, and dependencies, how many of these initiatives can realistically progress in parallel without quality loss?

How often does urgent operational work prevent planned security initiatives from progressing as intended?

Of your active security initiatives, how many have produced observable changes that reduced exposure or increased recoverability in the last 90 days?

When was the last time a security initiative was explicitly paused or stopped to reallocate focus or capacity?

If 2 to 3 current security initiatives were paused, how likely is it that this would immediately create critical exposure?

Is there a role with clear authority to set security priorities, explicitly defer work, and accept risk trade-offs?

Is there a role with authority to stop initiatives, mandate security tests, and enforce corrective actions?

During a high-pressure security incident, how confident are you that escalation paths and decision authority would remain unambiguous?

When was your ability to detect a meaningful security incident last tested in a way that would surface failure?

When was your end to end incident response including decision making last exercised or tested?

When was recovery of critical systems or data last tested under conditions approximating real pressure?

When did the organisation last experience a real security incident or operational crisis that materially tested security assumptions?

How well are critical dependencies between security domains understood and actively managed?

Are any security capabilities currently relying on other domains that are known to be weak or untested?

If a critical security assumption proved wrong, how well do you understand the consequences based on tested or observed behavior?

If a critical system or domain were compromised, how reversible would the impact be within days?

When security priorities compete, how explicit and consistently applied is the logic used to choose between them?

Domain pressure

For each domain, describe its current operational condition.

Foundational domains

Select 2 to 3 domains that support multiple other security capabilities. If these weaken, broader operational stability is likely to weaken as well.

Priority domain

If leadership focus were limited over the next 90 days, which one domain would you prioritise first?

Reduced-attention domains

Select 2 to 3 domains that could temporarily operate with less leadership attention while the priority domain is addressed.

Generating your report

This can take a minute. Keep this tab open.

Report ready

Your report is ready. The PDF download has started.

No reliable conclusion could be reached

The current answers do not form a clear enough picture to reach a reliable conclusion.