We start with your business, not a framework.

Why “Outside The Box”

Most security advice arrives pre-packaged: a framework, a maturity model, a vendor’s reference design, each one built for some other firm and handed to yours unchanged.

Our consultants came up through the Big 4, government and financial services, so we know those methods from the inside. We kept the rigour and dropped the packaging.

Five principles

1. Start from the business

Security exists so the firm can take the risks it wants to take, safely. If a recommendation doesn’t trace back to something the business cares about, we don’t make it.

2. Plain English is a control

If your people can’t explain a control in a sentence, they’ll route around it within the week. The controls that get followed are the ones people understand.

3. Fewer things, done properly

A short list of controls that hold up beats a long one that impresses an auditor. Complexity is where risk hides and where budgets quietly disappear.

4. Both sides of the table

Chris came up through PwC and BAE Systems and has worked inside government, so he knows what examiners look for. That judgement is most of what you’re paying for.

5. Build for our absence

Every engagement leaves capability behind in your team. We measure success by what still works a year after we’ve gone.

The rigour of the big firms, without the box it came in.

What working with us is like

• Senior people do the work. The person you meet is the person you get.
• We tell you what we’d do in your seat, not what a framework lets us say.
• Deliverables are as short as the decision allows. Usually pages, not decks.
• If we’re the wrong firm for the job, we’ll say so and point you to who isn’t.