System Bloompath

Client stories

Evidence from desks that finished the engagement

These notes reference specific System Bloompath work — handoff packs, reporting programmes, analytics engagements, and board briefings — not generic praise.

“They sat with our night lead for two full handovers before touching any chart. The pack we use now still takes a moment to fill in when the queue is deep, but at least the morning desk stops asking us to reconstruct the whole night from memory.”
Adrian Kwok — SOC Manager, regional payments processor
Shift Handoff Visual Pack
“Our incident reports used to grow a new appendix every time legal joined the call. System Bloompath forced us to agree a section order first. The first draft after a ransomware scare still needed edits, yet we stopped arguing about where containment belonged.”
Priya Raman — Head of Information Security, logistics group
Incident Reporting Programme Design
“I was sceptical about another analytics engagement — we already own a capable SIEM. What changed was the board briefing. Helena’s team pulled a timeline our analysts recognised, not a slide deck of buzzwords. I would still prefer they push harder on residual risk wording, but the evidence held.”
Marcus Feldman — CISO, Hong Kong financial services firm
Board Incident Briefings
“During the SOC Analytics Engagement they refused to invent thresholds we could not defend with our own tickets. That slowed week two, and I am glad it did. The weekly review metrics we kept are the ones that actually change roster decisions.”
Elaine Tsang — Duty Operations Lead, managed security partner
SOC Analytics Engagement
“Clear working notes, on-time sessions at New Mandarin Plaza, and no attempt to sell us a monitoring subscription. We hired them to make severity language consistent across shifts — and that is what we got.”
Kenji Morita — Security Operations Coordinator
SOC Analytics Engagement

Extended note — payments processor night desk

Adrian’s team ran three overlapping shifts across Hong Kong and a secondary site. Before the Shift Handoff Visual Pack, outgoing analysts pasted ticket IDs into chat and hoped the morning desk would reconstruct priority. We observed two Friday night handovers, cut the view to open high-severity items, watchlist hosts, and external blockers, then practised the three-minute explanation rule. Volume on campaign weeks still hurts — Adrian is frank about that — but the morning reconstruction arguments dropped out of the weekly review.

Extended note — logistics security programme

Priya’s incident reports ballooned whenever legal joined late. The Incident Reporting Programme Design forced a fixed section order: confirmed facts, containment status, systems involved, then labelled speculation. The first live use after a ransomware scare still needed edits overnight, yet the argument moved from “where does this go?” to “is this fact or hypothesis?” — a narrower, more useful fight.

Start a conversation