Securing the Foundation:
A Comprehensive Cybersecurity Assessment for a Real Estate Investment Firm

Client Overview

A real estate investment and asset management firm operating across commercial property and residential development segments, with a portfolio spanning two continents. The organization managed assets across a range of asset classes and maintained a workforce of approximately 120, including corporate, investment, and property management functions. The business had expanded its digital footprint meaningfully over the preceding two years, deploying connected building management systems, an investor portal, and a data platform to support asset performance reporting.

The Challenge

As the organization’s digital environment grew, leadership recognized the importance of ensuring that its cybersecurity governance and controls kept pace. The board had noted an increase in sector-wide cyber risk across the real estate and investment management industries, and wanted to take a proactive approach to understanding the organization’s current security posture, rather than waiting for an incident to prompt action. The organization managed sensitive investor data, tenant information, and proprietary transaction records, all of which carried regulatory and reputational obligations. A third-party vendor review had also highlighted some data handling practices that warranted closer examination. Leadership commissioned an independent security assessment to establish a clear, evidence-based picture of where the organization stood and what steps it should prioritize to strengthen its position.

Our Approach

Levarcon’s Security Assessment and Gap Analysis engagement was scoped across four assessment domains: technical infrastructure security, identity and access governance, vendor and third-party risk, and security policy and compliance framework maturity. The assessment was conducted over eight weeks by a team of senior security consultants, operating under a clearly defined scope of work agreed with the organization’s Risk and Technology leadership.

Phase 1
The technical assessment involved external attack surface analysis, internal network security review, evaluation of the connected building management system environment, and penetration testing of the investor portal and asset analytics platform. No prior knowledge of the technical environment was provided to the assessment team for the external component, replicating realworld threat actor conditions.
Phase 2
The identity and access governance review mapped the organization’s Active Directory environment, privilege access management practices, and third-party access controls. This was an area identified early as potentially high-risk given the number of external property management contractors with system access.
Phase 3
The vendor and third-party risk assessment evaluated the security practices and contractual obligations of the organization’s most material vendor and service provider relationships, using Levarcon’s proprietary Third-Party Risk Scoring Framework.
Phase 4
Findings from all four domains were synthesized against the NIST Cybersecurity Framework and the ISO 27001 control framework, producing a consolidated maturity profile and a riskweighted gap register. A structured prioritization workshop was facilitated with the organization’s Risk Committee to align on remediation sequencing and investment requirements.

The Solution

Levarcon delivered a comprehensive Security Assessment Report encompassing an executive summary and board-ready risk narrative, a detailed technical findings register with severity classifications and remediation guidance, an identity and access governance gap analysis with specific remediation recommendations, a third-party risk scorecard across the firm’s most material vendor relationships, a maturity profile mapped against NIST CSF and ISO 27001, and a costed, prioritized remediation roadmap structured across three urgency horizons. A board briefing was delivered directly by Levarcon’s senior security leadership.

Results and Impact

The following outcomes were measured across the portfolio twelve months following full enterprise rollout:

4 critical

Unplanned system outages in the twelve months following full migration completion

Material vendors

Assessed across the firm’s most strategic third-party relationships, with elevatedrisk relationships flagged for action

ISO 27001

Remediation roadmap structured to achieve alignment within eighteen months

Board adoption

Full remediation roadmap approved within four weeks of assessment delivery

Zero breaches

No security incidents reported in the twelve months following implementation of priority remediation actions

The assessment provided the organization’s leadership with a clear, evidence-based understanding of its security posture for the first time. The board’s rapid adoption of the remediation roadmap reflected both the urgency of the findings and the quality of the risk communication Levarcon provided. Twelve months following delivery, the organization’s security capability had been materially strengthened, with critical vulnerabilities remediated, third-party risk controls operationalized, and a security governance framework established to sustain the investment over time.

Client Reflection

The Chief Risk Officer reflected: “We had a sense that our security posture was not where it needed to be, but we did not have an authoritative picture of what that actually meant in practice. Levarcon provided exactly that, a rigorous, independent assessment that gave our board the clarity to act decisively. The quality of the analysis and the professionalism of the delivery were exceptional.”

Conclusion

In an era where real estate organizations are increasingly dependent on connected systems, investor-facing digital platforms, and complex third-party ecosystems, the security risks are both significant and often underestimated. Levarcon’s Security Assessment and Gap Analysis service provides the independent, authoritative view of organizational risk posture that boards and executive leadership need, and a clear, actionable path to a more defensible security position.

Let's Talk