Services
The work, by who it’s for.
Four kinds of clients, each asking a different question about cyber risk. Every engagement is scoped to the decision in front of you, your timeline and your budget.
Boards
Cyber risk oversight
“Are we overseeing this well, and how would we know?”
Directors are accountable for risks that did not exist when most of them joined the board. They do not need to become technologists. They need the few questions that matter and a reliable way to judge the answers.
AI and emerging technology risk
Framing AI, emerging technology and digital transformation risk so the board can oversee it without becoming expert in it.
Committee charters and integration
Designing a cybersecurity committee charter, or folding cyber oversight into the existing audit and risk committees where a separate committee is not warranted.
Director briefings
Sessions on cyber and AI risk built around what the board is responsible for overseeing, rather than general awareness training.
Venture Investors
A buyer’s read on cyber deals
“Will a CISO actually buy this, and where is our portfolio exposed?”
Most security pitches are judged by people who have never had to buy the product. Our principal has sat on the buying side of that table as a CISO, through the pitch, the evaluation and the budget decision.
Security startup thesis
A CISO’s view of whether a company solves a problem security leaders fund, and whether its product and team would hold up in an enterprise evaluation.
Portfolio risk reviews
A consistent read of security posture across portfolio companies, so the fund knows where exposure sits and which companies need attention first.
Founders
Credibility that moves enterprise deals
“Why does the CISO like the demo and still not buy?”
Security products are bought by people who have spent a career being sold to badly. The gap is rarely the product. The pitch describes features to a buyer who is funded to reduce risk, and who can tell within a minute whether the person across the table has ever been the one on call when it went wrong.
Go-to-market with CISO buyers
Building the external credibility that shortens enterprise adoption, before adding another channel to a message that is not landing.
CISO communication strategy
Translating what the product does into the terms security leaders budget against: risk reduced, work removed, headcount not needed.
Security-first sales enablement
Equipping the sales team to earn a CISO’s trust and to move through enterprise security review without stalling the deal.
Corporations
Security strategy, and the program to deliver it
“What should our security strategy be, and how do we build the program to deliver it?”
Some companies have no CISO. Some have one who needs air cover at the board. Either way the work has the same shape: set a security strategy tied to the business, build the program that delivers it, and report on it in a form the executive team and the board can both act on.
Security strategy
A strategy built around how the business makes money and where it is exposed, so security investment follows business priorities.
Posture assessment
An honest read of where the program stands today: the baseline the strategy is built from.
Program roadmap
What to build in what order, paced to the capacity the organization actually has rather than the capacity a framework assumes.
Program, policy and governance build-out
The program structure, the policy set and the ownership map, written on your templates so it reads as yours.
Board and committee reporting
The material that goes to the board or the executive committee, built so directors can exercise oversight and executives can make the call.
Support through transformation
Ongoing senior judgment across a period of change, where the need is continuity rather than a single deliverable.
Not sure which seat you’re in?
Most engagements don’t arrive neatly labeled.
Tell us what you are facing and we will tell you whether we are the right fit.