Monty & CoMonty&CoLearn
Beau-TieExamples

Walkthrough — Cybersecurity data breach (Beau-Tie)

The Customer data breach bow tie is the worked example that ships inside Beau-Tie: one risk event with two causes, two consequences and eleven controls, compact enough to read whole and complete enough to exercise the editor. On your first visit to /bow-tie this is exactly what's on screen; if you've since saved your own work, choose Sample bow tie from the New menu to bring it back and follow along live. Compact as it is, it covers every mechanic of the editor: four of the editor's five control types, both statuses, and a meaningful residual-to-target gap, without the diagram becoming hard to read.

If the vocabulary here is unfamiliar, read What is a bow tie? first; this page is the "see one built" companion to it.

The risk event

Centre of the diagram, in the ink-coloured box:

Loss of sensitive customer data

Description: "Unauthorised access to or exfiltration of customer-identifying information." Notice the phrasing: noun-form, no embedded cause or consequence. "Hackers steal data" would embed a cause; "Customers lose trust" would embed a consequence. "Loss of sensitive customer data" is the event itself.

The two causes

Two pathways the event could occur through, distinct enough that the controls on one line don't overlap the controls on the other:

1. Phishing of staff credentials

Three controls on this line:

  • Phishing awareness training: preventive, existing, partially effective. ("Quarterly simulated-phishing program for all staff.")
  • Email filtering: preventive, existing, substantially effective. ("Cloud anti-spam and link-rewrite filtering at the gateway.")
  • MFA rollout: preventive, planned, 0–3 months. ("Phishing-resistant MFA on all SSO-protected apps.")

2. Unpatched software vulnerability

Three controls:

  • Patch management process: preventive, existing, partially effective. ("Monthly review and rollout of vendor security patches.")
  • Vulnerability scanning: detective, existing, substantially effective. ("Weekly automated scans across the production estate.")
  • Automated patching pipeline: preventive, planned, 3–6 months. ("CI-driven rollout of OS and library patches with canary stages.")

The two consequences

Regulatory fines and penalties

Two controls:

  • Breach notification protocol: corrective, existing, substantially effective. ("Documented 72-hour regulator notification workflow.")
  • Privacy compliance program: directive, existing, highly effective. ("Annual privacy review and DPIA for new initiatives.")

Reputational damage

Three controls:

  • Crisis communications plan: corrective, existing, partially effective. ("Pre-approved messaging templates and escalation paths.")
  • Customer notification process: corrective, existing, substantially effective. ("Templated, tested customer-impact notification flow.")
  • External PR retainer: corrective, planned, 0–3 months. ("On-call public-relations partner for incident response.")

Reading the controls as a set

The eleven controls demonstrate the full vocabulary. The cause side is preventive and detective work: stop the pathway, or notice it early. The consequence side is corrective: limit the damage once the event has happened. The one directive control, the privacy compliance program, sits on the regulatory line because it shapes behaviour to support the other controls; it doesn't block a breach or respond to one, it keeps the organisation in a state where the notification protocol works and fines are defensible. Eight controls are existing (rendered solid), three are planned (rendered dashed, each carrying an implementation timeline).

Note the effectiveness spread: the two strongest pathways to the event, phishing and unpatched software, are each anchored by a control that is only partially effective (the training and the patch process). That is the detail the residual rating below is arguing from.

The ratings

Two points are plotted on the 5×5 matrix (appetite is deliberately not set):

  • Residual: L4 × C4 = High (Likely × Major). The argument: with training and patch management only partially effective, a phishing or vulnerability pathway getting through is likely on the matrix's terms, and the consequence of customer-identifying data leaving the organisation is major on both the regulatory and reputational lines.
  • Target: L2 × C3 = Moderate (Unlikely × Moderate). Where the organisation believes it lands once the three planned controls are delivered: phishing-resistant MFA takes the credential pathway from likely to unlikely, the automated pipeline closes the patch gap, and the PR retainer softens the reputational tail.
  • Appetite: not set. Acme hasn't recorded an appetite position here, and the sample leaves the marker off rather than inventing one. Setting it is an organisational decision (ISO 31073:2022 defines appetite as the amount and type of risk an organisation is willing to pursue or retain), not something an analyst does in isolation.

The treatment path

The three planned controls are the bridge from residual to target:

  • 0–3 months: MFA rollout (cause side) and the external PR retainer (consequence side).
  • 3–6 months: the automated patching pipeline.

When a planned control lands, its status flips to existing and it gets an effectiveness rating. The residual doesn't move by itself: delivery is the moment to re-argue it against the evidence that the control actually works, and to move the marker deliberately. Reaching L2 × C3 = Moderate is the claim being made; the diagram is what makes that claim auditable.

Exporting the result

Every format is one click from the Export menu: the JSON envelope for backup and handoff, the 16:9 presentation PNG for decks, the one-row Excel register for treatment tracking, the A4 landscape PDF report (diagram first, then the record detail with register tables and the planned-controls roadmap), and the PowerPoint deck. Using Beau-Tie describes each format in detail.

Things to try

  • Add an appetite marker. Open the Ratings panel and set appetite to, say, L2 × C2 = Low. Watch how the three-marker picture reads differently from two: the gap between appetite and target is now itself an argument.
  • Add a third cause. The built-in Cybersecurity data breach template (under New) models insider threat and third-party supplier compromise as well; add an insider-threat cause to the sample and think about which of the existing controls, if any, sit on the new line too.
  • Stress the ratings. Change phishing awareness training from Partially Effective to Not Effective, and ask whether L4 still holds or the argument now points at L5. The tool won't move the marker for you; noticing that it should move is the skill the diagram trains.

What this bow tie can't show

Two limits worth naming, both covered properly on the methodology page. The diagram can't express conditions that would defeat a control (an escalation factor such as "MFA fatigue attacks succeed against push-based MFA"), and it can't express pathways that are not independent: a bow tie has no AND gates, so "phishing and an unpatched perimeter host in combination" is beyond what the drawing can claim. If those interactions are the point of your analysis, a fault tree or a quantified model is the right next tool.