Change that survives contact with Monday morning.

Why most transformation programmes stall.

The pattern is familiar. A regulation lands, a programme is stood up, a big firm arrives with a maturity model, and a year later you own a few hundred pages nobody reads and a set of controls people quietly work around.

DORA and NIS2 aren’t document requests. They ask whether your firm actually behaves differently under stress, and that’s a question about your operating model, not your paperwork.

No number of pages of policy has ever stopped an attack on its own. People and habits do.

How a programme runs

1. Diagnose (weeks 0 to 6). We map how security actually works day to day, not how the documents say it does. You get an honest picture of the gaps, in priority order.
2. Decide (weeks 6 to 10). Operating model, controls and priorities agreed with your executives. The change has owners before it has milestones.
3. Deliver (weeks 10 to 26). We work inside your teams, retiring controls nobody can explain, building fewer and sharper ones, and testing them until they hold.
4. Hand over (from week 26). Capability moves across to your people, cadence by cadence. What still works a year later is the point.

Where we’re usually called in

• The compliance binder is full, but nothing about how you work has changed.
• Last year’s audit actions are back, with new owners and new dates.
• Resilience tests are theatre: everyone knows the scenario in advance.
• A programme is mid-flight and sinking, and the next steering committee needs a different story.