Advisory & Consulting
Independent advice, with no product to push.
Senior security leadership without the headcount: a clear-eyed assessment of where you stand, a risk picture your board can act on, and a costed roadmap that fixes what matters first. Vendor-agnostic by design, so the advice serves you, not a product line.
When companies bring us in
If one of these sounds familiar, you’re in the right place.
“A client or our insurer wants ISO 27001 or a completed security questionnaire, and we can’t answer it honestly.”
“The board has asked how exposed we really are, and we need a straight answer, not a dashboard.”
“Security has outgrown being someone’s side job, but a full-time CISO isn’t justified yet.”
“A regulation like DORA or NIS2 now applies to us, and we don’t know where to start.”
Flagship services
Two engagements most companies start with.
Cyber Assurance Assessment
Understand your cyber risk before investing in more technology. A structured maturity and posture assessment, gap analysis ranked by risk, board-level reporting and a prioritised improvement roadmap.
ExploreVirtual CISO (vCISO)
Strategic security leadership without the cost of a full-time CISO. A named senior advisor who owns your governance, strategy, risk and board reporting on a retained basis.
ExploreWhat else advisory covers
Named engagements, not open-ended consulting.
Board-level risk assessment
Your risks set out in business terms, with likelihood, impact and the cost to fix, so the board can decide what to fund with its eyes open.
Prioritised remediation roadmap
A sequenced 12 to 24 month plan that tackles the highest risks first and fits the budget and the people you actually have.
Regulatory & certification readiness
Get ready for what clients and regulators now ask for: ISO 27001, SOC 2, DORA and NIS2, plus preparation for the EU AI Act.
Incident readiness review
A straight test of whether you could really respond: a response plan, defined roles and a tabletop exercise with your leadership team.
AI governance has its own home under Compliance: helping you govern your own use of AI and prepare for the EU AI Act.
What you walk away with
Documents you can act on, not a slide deck.
- A posture scorecard against your chosen framework, every gap ranked by risk
- A board-ready risk register, written in plain English, not jargon
- A costed, prioritised remediation roadmap you can actually resource
- A straight recommendation on what to keep, what to change and what to drop
- One senior advisor accountable for all of it, start to finish
Where it leads
Advisory is the start of the conversation, not the end.
Start with an honest read of where you are.
A 30-minute call with a senior advisor. Bring your situation; leave with at least one useful answer, whether or not we’re a fit.
Book a call