About

Federated Cybersecurity™ is a family of methodologies for the parts of security that depend on people. Each one takes a kind of work that a central team cannot do for a whole organization and divides it among the teams best placed to do it, on shared principles and in a common language.

There are three, and they share a common foundation. Federated Cyber Risk covers an organization's own resources. Federated Practice Monitoring shows teams, units and the security office how the practice is running. Federated Third-Party Risk, for vendors and other outside parties, is the newest and was added in 2026.

The methodologies have been developing since 2018.

2018

Foundation Sonya Lowry begins working on a problem that security programs had historically solved only by adding staff: how to scale administrative controls in a decentralized organization. The foundation of the methodology is developed over the year.

2019

First use The first tools built to enable the methodology are rolled out, for cyber risk management and security planning.

Refinement Through 2019 and into 2020 tools and methods are tested and adapted.

2020

Commercialization Work begins on turning the approach into a commercial offering.

2021

Product release Sibylity, the first commercial product built to enable the methodology, is released to its first customer.

2023

Validation That first customer reaches participation by 100% of its units.

Expansion QuickPlans are added: guided security plans that a resource team can complete in under an hour.

2024

Expansion Compliance Checkups are added, as a safe way for a team to work toward compliance.

Expansion Dependency tracking is added, with Cheese Flags to mark the plans affected when a shared control changes.

2025

Expansion Process monitoring is added. It shows the security office how well the process is working and what the security posture is, however decentralized the organization.

2026

Expansion Process monitoring grows to include remediation tracking and becomes a methodology of its own, Federated Practice Monitoring.

Expansion Third-party risk is added as a methodology, Federated Third-Party Risk. It shares the dependency graph and Cheese Flags with Federated Cyber Risk.

Syzygy Technology Services LLC develops the methodologies, holds their copyright and trademarks, publishes this site, and grants commercial licenses. The terms of use set out what is free and what needs a license.

Sonya Lowry is the Lead Researcher and principle author of the methodologies. She has worked across systems architecture, cybersecurity, data science and applied AI for more than 25 years, and holds the CISSP credential.

Sonya Lowry is also the founder and chief executive of SibylSoft, Inc.

SibylSoft's product, Sibylity, is a commercial implementation of Federated Cybersecurity methodologies, built under license from Syzygy.

The methodologies are published here, apart from any product, so that an organization can use them with Sibylity, with other tools, or with none.

• Sibylity, by SibylSoft: a licensed commercial platform that implements the Federated Cybersecurity methodologies.
• University of Arizona case study, published by SibylSoft: the methodology in use across a large university.

If your organization has put one of the methodologies into practice, we would like to hear about it.

Questions about the methodologies or about licensing: inquiries@federatedcybersecurity.com