Services: fractional CISO
A CISO, two days a week.
Security leadership from people who've held the seat, without the £200k hire or the six-month search.
You need the leadership before you can justify the hire.
Most mid-size regulated firms reach the same point. The security questions from the board, from clients and from regulators now need someone senior to answer them. But a full-time CISO is a £200k commitment, the search takes the better part of six months, and the work doesn’t yet fill a week.
The regulation won’t wait for the headcount. DORA and the FCA both expect senior management to understand security risk and answer for it, which takes someone credible advising them. That seat can’t sit empty while the business grows into the hire.
Your people get air cover. You get a straight answer.
What you get
At your top table
A senior adviser on security risk, in the room where the business decides what to accept.
Facing your regulator
DORA, NIS2, the FCA: handled by people from both sides of that table.
Leading your worst day
A practised hand on the incident: decisions, comms, board. In that order.
Building your people
Capability compounds in your team, not ours. We plan our own exit.
Ways to work together
| Shape | Cadence | Best when |
|---|---|---|
| Embedded | 1 to 2 days a week | You need a standing CISO. The usual shape. |
| Interim | Full-time, 3 to 9 months | The seat can’t sit empty while you hire. |
| Advisory | Monthly, plus on-call | Your security lead needs senior backing, not replacing. |
Where we’re usually called in
- The first senior security hire is a year away. The firm is growing, and the questions have arrived early.
- An FCA authorisation or DORA deadline needs a senior security lead who can advise the board and answer the regulator’s questions.
- The CISO has left and the search will take months. The risk register doesn’t pause.
- Your security lead needs senior backing rather than replacing: cover for the board, counsel on the hard calls.
What we have written about this
Stop showing your board heat maps.
The red-amber-green matrix is the most successful piece of assurance theatre ever staged. What to put in the board pack instead, and why your NEDs will thank you for it.
A threat-led cyber security strategy for 2025.
What the threat intelligence from Mandiant, Verizon, CrowdStrike, IBM and Microsoft actually says — and the five strategic priorities that fall out of it, with the evidence for each.