Strategic advisory
Short engagements that end with a clear decision and the reasoning behind it.
- Security design and architecture review
- High-level target architecture
- An independent view on vendor choice
- A second opinion before a major commitment
Services
Four practices, delivered as short advisory work, assessments, long-term programmes or a virtual CISO. Every engagement is independent of any vendor and led by the founder.
Practice
AI security
AI you can put in front of the board: models, retrieval and agents, governed before they reach production.
Most organisations are already running AI in more places than their security team can name. The questions are the same everywhere: what can this system reach, what can it be talked into doing, and who answers for it when it does.
We answer them from the architecture up. We map the system, find where its trust boundaries really are, and design controls that can be measured rather than trusted.
What we do
- AI security strategy and a governance model the board can own
- Threat models for LLM applications, retrieval and agents
- Reference architectures for AI gateways and guardrails
- AI security assessments and red-team scoping
- Readiness for the EU AI Act, ISO/IEC 42001 and sector regulators
Practice
Zero trust
An architecture you build over time, not a product you buy once.
Zero trust has been sold as a product category for long enough that the term now means whatever the last vendor said. We start from your estate as it is: your identity provider, your network, your applications and the paths an attacker would take through them.
The result is a target architecture and a roadmap in phases, each of which reduces risk on its own, so the programme is worth funding before it is finished.
What we do
- Zero trust maturity assessment against your own estate
- Target architecture across identity, devices, network and data
- Segmentation design that removes lateral movement
- A phased roadmap with the business case for each phase
- Independent evaluation of the vendors on your shortlist
Practice
Cyber security
Strategy, architecture and assessment across infrastructure, cloud and applications.
A security programme is only as good as its link to the risks the business carries. We work with CISOs, CIOs and CTOs to set that direction, then hold the architecture and the controls to it.
What we do
- Security strategy, operating model and roadmap
- Security architecture review for infrastructure, cloud and applications
- Infrastructure, cloud and application security assessments
- Vendor selection, run independently
- Board and regulator reporting
Practice
Data protection
What you hold, where it moves, who may see it, and the controls that survive an audit as well as an attacker.
Data protection fails in the gap between the policy and the systems. We close it from both ends: the obligations that follow the data, and the technical controls that enforce them.
What we do
- Data discovery, classification and flow mapping
- Privacy programmes for India's DPDP Act and the GDPR
- Data protection impact assessments
- Data loss prevention and encryption architecture
- Data protection assessments against your obligations
Assessments
Findings you can act on
Every assessment ends with findings ranked by risk to the business, the evidence behind each, and what to do about it, in that order.
AI security
Models, retrieval, agents and the platform they run on, against how they can be attacked and how they are governed.
Cyber security
The security programme as a whole: strategy, governance, controls and how they hold up in practice.
Infrastructure
Networks, identity and the core systems the business depends on, and the paths between them.
Cloud
Configuration, identity and segmentation across your cloud accounts, against a known baseline.
Application
The design and the code of the applications that carry your data, and the services around them.
Data protection
Where personal and sensitive data lives, who can reach it, and whether the controls meet your obligations.
Engagements
Short or long, the same senior attention
Engagements are sized to the question. A short one ends with a decision; a long one ends with the change made.
Programmes
Long-term engagements that stay until the change is delivered.
- Programme and project management
- Change management across teams
- Deployment services, through to handover
- Assurance at each phase gate
Virtual CISO
Security leadership for as long as you need it, answering to your board.
- Security strategy and board reporting
- Policy, governance and audit readiness
- Independent architecture and vendor decisions
- Preparing the permanent hire
Tell us what you are deciding
A first conversation is with the founder, not a sales team. We reply within one working day.