Peregrine Risk Group — Security leadership, simplified.

Services

vCISO & GRC

Board-ready strategy, policies, audits (SOC 2, HIPAA, PCI), third‑party risk.

Risk Quantification (FAIR)

Translate cyber risk into dollars with defensible estimates, KRIs, and mitigation ROI.

Testing

Internal, External, Web Application , and Cloud penetration Testing

Approach

Baseline — assets, data flows, and controls maturity (NIST CSF 2.0, CIS).
Quantify — FAIR scenarios for top loss drivers (creds, ransomware/extortion, third‑party).
Prioritize — by $ risk reduction, not checkbox compliance.
Operationalize — playbooks, KRIs, dashboards, exec reporting.

Risk Calculator (DBIR‑informed defaults)

Defaults below are informed by Verizon DBIR 2025 patterns (e.g., credential abuse ≈22% initial access; vulnerability exploitation ≈20%; third‑party involvement ≈30%). Adjust to your environment. This tool is for demonstration only.

Company (leave blank if you wish)

Annual Revenue ($)

EBITDA ($)

Employees

Scenario & Size

Company Size Scenario Estimated Event Frequency per Year

LEF: 1 events/year (preloaded from DBIR pattern & size; adjusted by maturity/mitigations)

Loss Magnitude P10 ($)

Loss Magnitude P50 ($)

Loss Magnitude P90 ($)

Control Maturity

Mitigations

Approximate effects typical in DBIR‑aligned programs.

MFA everywhere (‑35% freq)
Patch SLAs ≤30 days (‑25% freq)
Email security/awareness (‑20% freq)
Immutable/offline backups (‑40% magnitude)
IR plan + tabletop tested (‑20% magnitude)
Privileged access hardening (‑15% magnitude)

Results

Adj. Frequency

—

ALE (P50)

—

3‑yr Cum. (P50)

—

ALE (P10)

—

ALE (P90)

—

Magnitude (P50)

—

Estimates are directional for demo purposes and not formal financial advice.

Defaults informed by Verizon DBIR 2025 patterns (credential abuse ~22% initial access; vulnerability exploitation ~20%; third‑party involvement ~30%).

About

At Peregrine Risk Group, we bridge the gap between construction expertise and cutting-edge cybersecurity.

Based in Birmingham, Alabama, we specialize in helping general contractors strengthen their security posture through proven processes, well-defined procedures, and the integration of best-in-class tools.

With years of experience working alongside the construction industry, we understand the unique operational challenges, compliance requirements, and technology risks contractors face. Our industry insight allows us to design security strategies that not only protect sensitive data and systems but also fit seamlessly into existing workflows-keeping projects on schedule and budgets in check. Our approach is hands-on, pragmatic, and results-driven.

We partner with leading solutions providers, to deliver enterprise-grade vulnerability management and risk reduction to firms of all sizes. Whether it's safeguarding project data, securing remote jobsite networks, or ensuring regulatory compliance, our mission is simple: help general contractors build with confidence in a secure digital environment.

Security leadership, simplified.