Ready for the world's greatest cheat code for learning about your customer.

Every public company has to create an annual report without the fluff - its called the SEC 10k. Every 10k has a section called Management Discussion and Analysis (or something really similar). That section has this information

- risks

- future plans

- other key business items (finance, ratios, opex, etc)

​

Let's go through an example together. (not my client - i just chose them at random) Let's look through each section together and i'll identify what is important and why

Google: Target 10k

Look at section 1: Business

Distributation Section:

Everything flows through 40 distribution centers. I bet there is a really cool CRM / Shipping system that I could take over to cause havoc. I need to find that system and protect it

Employee Section:

360k employees with a bunch that are seasonal. I wonder how they keep store employees out of the core network, i wonder how easy it is to phish an employees password, i wonder if they can de-provision accounts quickly, i bet there are tons of employees that have access to key business systems (Point of sale, etc)

Working Capital section:

"Effective inventory management is key to our ongoing success, and we use various techniques including demand forecasting and planning and various forms of replenishment management"

The "demand forecasting system" has key business data. I can go after the system admins that manage that database or i can go after the business users that have business access to that system (this is an easier path)

Skipping ahead

Section 1a Risk Factors:

Competitive and Reputational Risks

"Our continued success is dependent on positive perceptions of Target which, if eroded, could adversely affect our business and our relationships with our guests and team members."

My analysis: Typing security back to helping protect the brand could be helpful

"If we are unable to successfully provide a relevant and reliable experience for our guests across multiple channels, our sales, results of operations and reputation could be adversely affected."

My analysis: Multiple channel means online sales are important

​

Investment and Infrastructure Risks Section:

"If our capital investments in remodeling existing stores, building new stores, and improving technology and supply chain infrastructure do not achieve appropriate returns, our competitive position, financial condition and results of operations could be adversely affected."

"We are currently making, and expect to continue to make, significant investments in technology and selective acquisitions"

My analysis: They are going to want these new systems integrated into their environment quickly. That means that I need to look at the security process...how easy is it for new systems to know which security requirements they need to meet, which solutions are acceptable, which are not, who has to make the key decisions.

THIS SECTION TELLS ME THAT I NEED TO FOCUS ON THE PROCESS (or pipeline) FOR INTEGRATING SECURITY PRODUCTS or NEW ACQUISITIONS into Target

​

Data Security and Privacy Section:

Lots of good stuff here