Beyond compliance: we build resilience

Scope and duration, not quality. Advisory is bounded work with a beginning and an end — a risk assessment, a roadmap, a governance framework, readiness for one particular standard. A vCISO is somebody holding the security leadership role continuously: making the decisions week to week and answering for them. Most organisations start with the first and move to the second when they realise the decisions keep arriving whether or not anyone is there to make them. Some go the other way and use advisory to sanity-check a CISO they already employ. If you are not sure which you need, that is a conversation rather than a proposal.

Because the report is the cheap part and we would rather not be paid for it alone. Every recommendation carries an owner, a date and a position in a sequence — and the sequence is what most reports skip, which is how a hundred and forty findings arrive at once and none of them get done. Where you want it, the same team carries the work through; where we are not the right people to do it, we say so and track it to completion anyway rather than closing the engagement at handover. And if what you actually want is the document — for a board, a buyer, an auditor — tell us, and we will scope that instead, for less.

With what you have, not what you ought to have. The first movement is always assessment: your current posture, the obligations that apply to you, your real risks and your business priorities, turned into a picture leadership can act on rather than a list of findings. That is deliberately the cheapest part of any engagement, because it is what makes everything after it arguable. There is also a free self-assessment on this site that takes a few minutes — for a smaller organisation it is often enough to make the first conversation a useful one.

By starting from business impact rather than from a severity score. A critical-rated vulnerability on a system nobody can reach and which holds nothing is not your first problem; an unremarkable misconfiguration on the system your revenue runs through is. So the assessment has to establish what genuinely matters to you before it ranks anything — which systems, which data, which processes you could not be without for a day, and who would notice. Generic severity is what produces a risk register nobody reads and a roadmap nobody follows.

Not “yes” — nobody credible says yes. What a board can act on is a small number of things: where you stand against the standard you have chosen, what has changed since they last asked, what risk you are carrying deliberately, and what you need from them in order to change it. Translating between technical reality and that conversation is one of the three things this service exists for, and reporting in that shape is part of what you get rather than something your team assembles afterwards at midnight.

With whether they apply to you and over what scope, which is less obvious than it sounds and is where most of the wasted effort goes. After that the work is much the same whichever regime it is: settle what is in scope, measure against the requirements, rank the gaps by risk and by how hard they are to close, and assemble the evidence as you go rather than in the fortnight before an audit. The order matters more than the framework — governance, knowing what you have and a risk picture come before monitoring and detection, whatever the standard is called. And if you already have a date in the calendar, that is a different and more urgent shape of engagement.

Either, and we will tell you which before you commit to anything. We do implementation work — deploying and configuring security tooling, hardening, firewall and network work — so the advice can be carried through by the people who wrote it, which avoids the translation losses that make good roadmaps fail. But the advice does not depend on our doing it. Some of it belongs with your own team, and some with a supplier you already have, and saying so is part of what you are paying us for. A recommendation that can only be delivered by the firm that made it is worth reading twice.

That is most of the value, and it is easier for us than for somebody on your payroll. We have written the comparison that argued against a product we could have sold. Our hardening work routinely defers findings rather than recommending them, where the change carries more risk than the gap does. And we will say when something is not worth fixing, which is a harder sentence to write than a list of everything that could theoretically be improved. We are also certified against ISO/IEC 27001 ourselves — somebody audits us on the same basis we are asking you to accept, which makes the bluntness easier in both directions.

Three shapes. A paid one-off assessment runs in weeks at a fixed price, and is the usual way in. A fixed-scope project — a governance framework, a roadmap, readiness for one standard — is scoped and priced up front against a defined deliverable, so you know what you are buying before you buy it. Continuous advisory, where we hold the role rather than visit it, is the vCISO engagement: monthly, on a twelve-month minimum. What moves the number in every case is scope — how many systems and sites are in it, which regime applies, and how much of the work you want to keep in-house.