About
About CCDS
Detection is not the problem it used to be. Deciding what to do about it is.
Why CCDS exists
For three decades the industry pursued a rational goal: detect more, and detect faster. Firewalls became next-generation firewalls. Antivirus became endpoint detection and response. SIEM matured into XDR. By almost every technical measure, organisations defend themselves better than at any point in history.
And yet incidents keep growing in frequency, sophistication and business impact. The reason is not that detection failed. It is that detection succeeded, and something else did not keep pace.
Each tool does its job well. Together they produce a fragmented picture that takes considerable human effort to reconcile. Information is abundant; understanding is scarce. Teams can identify technical events but struggle to say which ones deserve executive attention today, which represent strategic business risk, and which can safely wait. More time goes into managing complexity than reducing risk.
Visibility without context overwhelms analysts. Automation without prioritisation just accelerates low-value work. That gap — between knowing and deciding — is what we built CCDS to close.
Built by practitioners, not software developers
This distinction matters more than it may sound. CCDS was not designed by a product team that studied the cybersecurity market from the outside. It was designed by people who have spent their careers inside security programmes — running operations, conducting audits, responding to incidents, advising governments and building capability in complex environments across the United States and Europe.
The difference shows up in what the platform chooses to do. It is organised around the decisions a security leader actually has to make, not around the modules a vendor happens to sell.
What we believe
Context before data
The same vulnerability can demand immediate remediation in one organisation and sit safely in a backlog at another — because business criticality, exposure and compensating controls differ. Context has to come before scoring, not after it.
Decisions before dashboards
Plenty of platforms measure success by how much information they display. A dashboard earns its place only if it produces faster, more consistent, better-informed action.
Confidence, not complexity
Every recommendation should be explainable. If a security leader cannot see why the platform reached a conclusion, they cannot defend the decision to a board — and they should not have to.
The company behind it
CCDS is built by Cedars International, a multi-national consulting firm delivering cybersecurity, smart digital transformation and management consulting, with offices in Washington D.C. and Belgrade.
That work has included strengthening the cybersecurity capabilities of host governments and critical infrastructure operators across Europe and Eurasia, developing the action plan accompanying Serbia’s national AI strategy, and advising small and mid-sized enterprises toward investment readiness. CCDS itself came out of the Cedars Innovation Lab, where emerging technologies are tested and turned into working systems.
A new category
We call what we are building Cybersecurity Decision Intelligence. It is a deliberate departure from the detection-centric framing the industry has used for thirty years, and it defines success differently: not by how much a platform can see, but by how confidently an organisation can act on what it sees.