Gart Drops Public Workshops to Go Fully One-on-One

Over the past year we ran several publicly accessible workshops. They worked well and participants left with a threat model, a set of protocols, and in many cases the first honest conversation they had ever had about their risk profile with a security expert.

They also taught us that privacy of our clients must come first.

We kept groups small on purpose, and still, a public workshop puts people who don't know each other in one room to talk about the most sensitive subjects. The format capped what they could take away from the day.

Retiring public workshops. Doubling down on private advisory and training.

Every engagement from now on is private: one client, or one client's chosen circle, and us. Groups of up to 25 are possible, as long as it is your group: people you already know and trust, teams or families and friends.

Confidentiality and how we achieve it

Our training and advisory only work when the client can say everything, and a client can only say everything when nothing they say gets shared or stored.

• We keep no record of the advisory. 

• During private sessions, we make no notes, no recordings and keep no file on you as a client. Your threat model, your household, your travel, your holdings are discussed in the room, without any "listening devices" and if the engagement produces a written protocol, you hold the only copy.

• The only paper trail is the invoice.

• It carries what accounting law requires with a neutral service description, and issued to whichever entity and address you name. Beyond that and the contact details we need to reach you, we store nothing.

• Remote sessions run on our own call server.

• Advisory calls do not go through Zoom, Microsoft, Google, or any other third-party meeting service. We host our call server so no outside company holds a participant list, a meeting log, or a recording of what was said. 

• Payment can skip the intermediaries.

• A card payment leaves your name next to ours in a processor's database for years, subject to that processor's next breach. We advise clients to pay in bitcoin, which involves no processor, no card network, and no statement line linking you to a security advisory. For private sessions we also accept wire transfer. Your bank still sees it, and it is slower, but it takes the payment processor out of the chain. Cards remain possible if you prefer them; we would not recommend it for anyone trying to keep their security arrangements off the record.

We had our own back office audited

Confidentiality claims are cheap if the systems leak data. An independent security audit of the CRM we use for contacts and invoicing returned eight findings: three critical, three high, two medium. We fixed all eight.

Our training and advisory offering

Currently we offer three in-person programs, each at a location and date of your choosing, plus remote advisory calls.