Illustrative public-source research sample
Consulting sample: healthcare cybersecurity partner landscape
A complete illustrative handoff showing how a bounded vendor-landscape question becomes a source-traceable, decision-ready research product.
Illustrative scope: identify cybersecurity providers that merit deeper review for a mid-sized healthcare organization, separating ongoing managed-security candidates from GRC/advisory specialists. This is an initial public-source decision-support map, not technical due diligence or a vendor recommendation.
01 — Scope
Decision brief
The sprint starts by locking the business decision, target universe, evidence rules and fields before research begins.
Decision brief
- Decision / use case
- Identify cybersecurity providers that merit deeper review for a mid-sized healthcare organization, separating 24/7 managed-security candidates from GRC/advisory specialists.
- Target universe
- U.S.-accessible cybersecurity providers with explicit healthcare positioning and at least one managed security, cyber-risk, compliance or incident-response service.
- Geography
- United States / providers publicly serving U.S. healthcare organizations.
- Inclusion rules
- Official company source accessible; healthcare relevance explicit; provider offers a managed security, risk/compliance, cloud-security or incident-response capability.
- Exclusion rules
- Point solutions without broader managed/advisory fit for this question; unsupported claims; private customer data; technical/security judgments not established publicly.
- As-of date
- 2026-09-28
- Delivery standard
- Decision brief + structured landscape + source register + screening log + executive summary + QA/limitations.
- Evidence standard
- Every populated factual field maps to an identified official source; absence is reported as 'not found publicly' rather than inferred.
- Feasibility result
- GREEN across three representative entities (Fortified, Clearwater, eSentire): all five fields are answerable with public-source evidence, while blanks/partials remain acceptable.
Buyer-defined fields
| # | Field | Why it matters | Acceptance rule | If not verifiable |
|---|---|---|---|---|
| 1 | Healthcare positioning | Confirms direct relevance to healthcare operating and regulatory context. | Official site explicitly names healthcare as a core market, vertical or specialization. | 'Not clearly stated' |
| 2 | 24/7 managed detection / SOC | Separates ongoing security-operations providers from advisory-only firms. | Official site explicitly states MDR, 24/7 monitoring, SOC or equivalent continuous managed detection. | 'Not found publicly' |
| 3 | Incident-response support | Shows whether the provider can support preparedness and/or response beyond monitoring. | Official site states incident response, containment, response support, retainer, plan/testing or equivalent. | 'Not found publicly' |
| 4 | Risk / compliance advisory | Shows whether the provider supports healthcare risk, HIPAA/HITRUST/GRC or compliance work. | Official site describes risk, compliance, GRC, advisory or managed compliance services. | 'Not found publicly' |
| 5 | Cloud-security specialization | Distinguishes cloud-specialist providers from broader MDR/advisory firms. | Official site describes healthcare cloud security/managed cloud as a material part of the offer. | 'Not found publicly' |
02 — Decision handoff
Executive summary
The summary separates factual patterns from suggested next-review actions so the buyer can see what the public evidence supports and where deeper diligence is still needed.
What the public evidence shows
| Finding | Evidence | Decision relevance |
|---|---|---|
| Three providers combine explicit healthcare specialization with ongoing managed-security capability. | Fortified positions as a healthcare MSSP with 24/7 Threat Defense; Clearwater combines healthcare security/compliance with 24/7 managed security; ClearDATA offers healthcare-cloud MDR with 24/7 monitoring. | These are the clearest first-review candidates when healthcare context plus ongoing managed security are both mandatory. |
| Two scaled MDR providers have dedicated healthcare positioning but are not healthcare-exclusive. | eSentire and Arctic Wolf both publish healthcare-specific offerings alongside broad multi-industry MDR programs. | Useful if operating scale, broad integrations and mature MDR are more important than healthcare-only specialization. |
| Meditology is differentiated toward healthcare GRC/compliance rather than 24/7 MDR in the public sources used. | Meditology emphasizes healthcare GRC enablement, risk/compliance, managed compliance and incident-response planning/testing; a 24/7 MDR/SOC offer was not found in the reviewed sources. | Treat as an advisory/GRC-track candidate rather than assuming it substitutes for an MDR provider. |
Suggested next action
| Priority | Action | Why |
|---|---|---|
| 1 | Start managed-security diligence with Fortified, Clearwater and ClearDATA; confirm environment fit, coverage, response authority, service boundaries and commercial terms directly. | Their public positioning most clearly combines healthcare relevance with ongoing managed-security capability. |
| 2 | Evaluate eSentire and Arctic Wolf as broader MDR alternatives, and Meditology as a GRC/advisory alternative. Use an RFI/RFP or direct calls to validate pricing, SLAs, references, incident-response terms and technical integration before selection. | Those buyer-critical details are not reliably established by the public-source sprint and should be the next diligence layer. |
03 — Structured evidence
Company landscape
The working table combines buyer-defined fields with standard metadata, source IDs, visible limitations and confidence.
| Entity | Website | Qualification rationale | Healthcare positioning | 24/7 managed detection / SOC | Incident-response support | Risk / compliance advisory | Cloud-security specialization | Verification status | As-of date | Source IDs | Exception / limitation | Recommended review use | Confidence |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Fortified Health Security | https://fortifiedhealthsecurity.com/ | Official site positions Fortified as a healthcare cybersecurity MSSP and describes both advisory and 24/7 threat-defense services. | Healthcare-specific / MSSP partner for healthcare systems | Yes — 24/7 Threat Defense | Yes — incident-response program includes readiness plus immediate response support | Yes — healthcare cybersecurity advisory and regulatory-compliance positioning | Not established as a primary specialization in sources used | Verified / company-stated capabilities | 2026-09-28 | S01; S02 | Cloud capability may exist, but the reviewed sources do not establish it as a primary differentiator. | Healthcare-specialist managed-security shortlist | High |
| Clearwater | https://clearwatersecurity.com/ | Official site combines healthcare cybersecurity/compliance, MSSP capability, managed cloud services, consulting and assessments. | Healthcare-specific security and compliance | Yes — 24/7 monitoring / managed security | Yes — incident-response service and coordinated response support | Yes — cyber risk, compliance, consulting and assessment services | Yes — managed cloud services are part of broader offer | Verified | 2026-09-28 | S03 | This sample does not compare individual Clearwater service packages or pricing. | Healthcare-specialist full-spectrum shortlist | High |
| ClearDATA | https://www.cleardata.com/ | Official site is explicitly healthcare-cloud focused and publishes an MDR service for healthcare organizations. | Healthcare-focused cloud security / compliance | Yes — MDR with 24/7 threat monitoring | Partial — MDR includes response/neutralization; separate incident-response service not established in source used | Yes — HIPAA/HITRUST-oriented healthcare cloud compliance positioning | Yes — healthcare cloud is the core specialization | Verified / one partial field | 2026-09-28 | S04 | Incident-response scope should be confirmed directly if breach-response support is a hard requirement. | Healthcare-cloud managed-security shortlist | High |
| eSentire | https://www.esentire.com/ | Official site provides MDR across industries and publishes a dedicated healthcare cybersecurity offering. | Healthcare is a dedicated industry vertical; provider is not healthcare-exclusive | Yes — multi-signal MDR with 24/7 expert SOC / threat hunting | Yes — unlimited incident response is publicly offered | Partial — compliance support is a published use case, but not positioned as a healthcare GRC consultancy | Broad cloud coverage within multi-signal MDR; not healthcare-cloud specific | Verified / scope distinction noted | 2026-09-28 | S05 | Healthcare specialization is a vertical within a broader MDR business. | Scaled MDR benchmark / alternative | High |
| Arctic Wolf | https://arcticwolf.com/ | Official site publishes healthcare security-operations solutions plus MDR and incident-response services. | Healthcare is a dedicated industry vertical; provider is not healthcare-exclusive | Yes — MDR with 24/7 monitoring | Yes — separate full-service incident-response offering | Partial — healthcare page emphasizes compliance support; not a healthcare-only GRC consultancy | Broad cloud monitoring within MDR; not healthcare-cloud specific | Verified / scope distinction noted | 2026-09-28 | S06; S07 | Broader security-operations provider; public sample does not assess healthcare-specific service depth versus specialist firms. | Scaled MDR benchmark / alternative | High |
| Meditology Services | https://www.meditologyservices.com/ | Official site positions Meditology as a healthcare-focused GRC/cybersecurity partner with managed compliance and cyber-resilience services. | Healthcare-focused / healthcare GRC and cybersecurity | Not found publicly in sources used | Preparedness/testing yes — incident-response plan development, tabletop testing and resiliency work; live response not verified | Yes — core GRC, HIPAA/HITRUST, risk, compliance and managed-compliance focus | Not established as a core specialization in sources used | Verified with explicit gaps | 2026-09-28 | S08; S09 | Do not treat incident-response planning/testing as proof of 24/7 MDR or live breach-response service. | Healthcare GRC/advisory shortlist | High |
04 — Traceability
Source register
Each source is tied to the claims it supports rather than serving as a generic row-level citation.
| Source ID | Entity | Claim(s) supported | URL | Source type | Accessed | Evidence note | Use in deliverable |
|---|---|---|---|---|---|---|---|
| S01 | Fortified Health Security | Healthcare-specialist positioning; advisory services; 24/7 Threat Defense | https://fortifiedhealthsecurity.com/ | Official company site | 2026-09-28 | Primary public positioning and managed-security evidence | Landscape |
| S02 | Fortified Health Security | Incident-response program; readiness support; immediate response support | https://fortifiedhealthsecurity.com/press-releases/incident-response-program-announcement/ | Official company site | 2026-09-28 | Current incident-response program evidence | Landscape |
| S03 | Clearwater | Healthcare security/compliance positioning; MSSP; 24/7 managed security; incident response; managed cloud / consulting | https://clearwatersecurity.com/ | Official company site | 2026-09-28 | Primary company/service evidence | Landscape |
| S04 | ClearDATA | Healthcare-cloud positioning; MDR; 24/7 threat monitoring; healthcare compliance context | https://www.cleardata.com/cspm/managed-detection-and-response/ | Official company site | 2026-09-28 | Primary healthcare-cloud MDR evidence | Landscape |
| S05 | eSentire | Healthcare vertical; MDR; 24/7 SOC / threat hunting; incident response; cloud signal coverage | https://www.esentire.com/ | Official company site | 2026-09-28 | Primary provider capability evidence | Landscape |
| S06 | Arctic Wolf | Healthcare-industry positioning; 24/7 monitoring; healthcare compliance support | https://arcticwolf.com/solutions/industries/healthcare/ | Official company site | 2026-09-28 | Healthcare-specific positioning evidence | Landscape |
| S07 | Arctic Wolf | Full-service incident-response offering | https://arcticwolf.com/solutions/incident-response/ | Official company site | 2026-09-28 | Incident-response evidence | Landscape |
| S08 | Meditology Services | Healthcare-focused GRC/cybersecurity; risk, compliance, cyber-resilience and managed-service positioning | https://www.meditologyservices.com/ | Official company site | 2026-09-28 | Primary healthcare GRC positioning evidence | Landscape |
| S09 | Meditology Services | Managed compliance; incident-response planning/testing; risk-register/remediation support | https://www.meditologyservices.com/managed-compliance-services/ | Official company site | 2026-09-28 | Managed-service and IR-preparedness evidence | Landscape |
| S10 | Cynerio | Healthcare-tailored platform focused on medical / IoT / OT / IT asset security | https://www.cynerio.com/ | Official company site | 2026-09-28 | Used to document exclusion against this buyer question | Screening log |
05 — Exclusion discipline
Screening / exclusion log
Relevant-looking companies are not silently forced into the universe. Exclusions and non-assumptions remain visible.
| Entity | Status | Reason | Source ID | What was not assumed | Potential revisit trigger | Notes |
|---|---|---|---|---|---|---|
| Fortified Health Security | Included | Explicit healthcare MSSP positioning plus ongoing managed security and advisory capabilities. | S01; S02 | No cloud specialization inferred from sources used. | Buyer requires cloud-native specialization | |
| Clearwater | Included | Healthcare-specific security/compliance provider with 24/7 managed security and incident response. | S03 | No claim that every capability is in one commercial package. | Buyer requests packaging/pricing comparison | |
| ClearDATA | Included | Healthcare-cloud security/compliance provider with explicit 24/7 MDR. | S04 | Separate live incident-response service not assumed. | Buyer requires dedicated breach-response retainer | |
| eSentire | Included | Dedicated healthcare offering plus scaled 24/7 MDR and incident response. | S05 | Not treated as healthcare-exclusive or as a specialist GRC consultancy. | Buyer prioritizes healthcare-only provider | |
| Arctic Wolf | Included | Dedicated healthcare security-operations positioning plus MDR and incident response. | S06; S07 | Not treated as healthcare-exclusive or as a specialist GRC consultancy. | Buyer prioritizes healthcare-only provider | |
| Meditology Services | Included | Healthcare-focused GRC/cybersecurity and managed-compliance fit is explicit. | S08; S09 | No 24/7 MDR or live breach-response capability assumed. | Buyer needs advisory/GRC track | |
| Cynerio | Excluded | Healthcare-focused cyber platform is relevant, but current public positioning centers on medical/IoT/OT/IT asset security rather than the broader managed-security/advisory partner scope defined for this question. | S10 | A strong point solution was not treated as a broad partner substitute. | Buyer asks for medical-device / connected-asset security landscape | Demonstrates exclusion discipline |
06 — Quality control
Method & QA
The process is intentionally bounded: feasibility is tested first, unsupported facts stay blank or qualified, and the final handoff receives a human QA pass.
| Step | Owner | Action | Client-visible output | QA gate | Stop / rescope trigger |
|---|---|---|---|---|---|
| 1 | Client + William | Lock the actual decision, target universe, geography, exclusions and up to five buyer-defined factual fields. | Decision Brief | Every field is factual and action-linked. | Question is too broad or judgment-heavy. |
| 2 | AI | Test the schema on three representative entities; classify fields GREEN / YELLOW / RED. | Feasibility note / sample rows | No RED field enters paid scope. | Paid/private sources required or exceptions dominate. |
| 3 | AI | Research entities and capture field-level evidence/source IDs. | Landscape + Source Register | No unsupported inference; blanks allowed. | Source access fails or manual work dominates. |
| 4 | AI | Normalize values, deduplicate and maintain screening/exclusion log. | Clean landscape + Screening Log | Inclusion/exclusion rules are consistently applied. | Too many bespoke exceptions. |
| 5 | William | Review exception queue and spot-check source accuracy. | QA-approved dataset | High-risk facts trace to primary/official sources. | Credible QA cannot fit the validation time ceiling. |
| 6 | AI | Produce decision-ready summary: factual patterns, limitations and buyer next actions. | Executive Summary | Facts and interpretation are clearly separated. | Summary exceeds evidence. |
| 7 | William | Final skim and delivery approval. | Client-ready workbook | Scope, sources, caveats and next action are clear. | Total William time >1.5h at $199. |
| Standard metadata | Included | Entity, website, qualification rationale, verification status, as-of date, source IDs, exception note and confidence. | Does not consume the five buyer-defined fields | Makes the output auditable and reusable. | None |
| Revision | Included | One bounded revision against the locked criteria. | Updated workbook | No new scope hidden inside revision. | New fields/universe = new scope |
| Confidence legend | High / Medium / Low | High = direct official evidence; Medium = indirect but credible public evidence; Low = unresolved/partial. | Visible in deliverable | Low-confidence facts are not presented as settled. | Critical field remains Low |
Prefer to inspect the working file?
Download Excel workbook (.xlsx)
The complete sample is already viewable above. The Excel workbook is optional.