Cybersecurity & Risk Strategy
A risk posture that matches actual exposure, not a compliance exercise dressed as security.
Book a call- Format
- Fixed-scope review or board advisory
- Duration
- Typically four to six weeks
- Output
- Written risk assessment and prioritised recommendations
- Commercial basis
- Fixed fee
Sound familiar?
- The security tools are bought and the policy document exists.
- Nobody at board level can say what the actual exposure is, or what it would cost if realised.
- The board is being asked to sign off spend it cannot independently assess.
A risk nobody at board level understands is a risk nobody is managing.
Proportionate, theatre, or a real gap.
- AssessRisk posture against actual exposure, not a generic framework.
- SortWhere controls are proportionate, where they are theatre, where a gap sits.
- TranslateTechnical risk in terms a board can weigh against other priorities.
- PrioritiseRecommendations sized to actual impact.
What you can say afterwards
- What is exposed
- What it would cost
- What is being accepted
- What to do first
What changes
BeforeSpend justified by fear or fashion.
AfterSpend justified against real exposure.
BeforeRecommendations sized to vendor enthusiasm.
AfterRecommendations sized to actual impact.
BeforeRisk accepted because nobody noticed.
AfterRisk consciously accepted, or managed.
BeforeReporting that falls over at a direct question.
AfterBoard reporting that survives one.
Done before
- CISOand CSO: security posture across engagements, and regulatory audits across outsourced businesses.Outsourcing and consulting
- ResearchIP protected at a UK university: new security stack, awareness training, full vulnerability remediation.Higher education
- 99.9999%availability across global sites, on secure infrastructure with recovery plans tested for real.Defence manufacturing
Before you book
How long does the assessment take?
Typically four to six weeks, whether run as a fixed-scope review or ongoing board advisory.
How is this different from a standard security audit?
A standard audit usually checks controls against a framework. This states the actual exposure in business terms, what’s exposed, what it would cost and what’s being accepted rather than managed, informed by having held a CISO role, not just advised on one.
What do we receive?
A written risk posture assessment and a prioritised set of recommendations sized to actual impact rather than vendor enthusiasm, in board-ready form.
Is this pitching a particular security product?
No. There’s no tool or platform behind the recommendations, which is precisely the gap this fills for boards used to being sold a security stack alongside the advice.
How is it commercially structured?
A fixed fee, agreed before the review starts.
One conversation.
No obligation. The right fit matters more than the right brochure.
One-page summary (PDF)