We help
protect your
data. systems. reputation. business.

Three ways, depending on what you need. A one-off assessment when you want to know where you stand. A focused project when you have a specific thing to build, fix or prepare for — an ISO 27001 readiness effort, a penetration test, a set of policies. Or an ongoing partnership where we act as your security function over time.

Most engagements start small and grow as trust does. We scope around your environment and risk, not a fixed package.

No — but it's easy to do the wrong-sized version. A small business doesn't need the security programme of a bank, and we won't sell you one. We scale the work to your actual size, risk and obligations: the same method, less weight.

The goal is sensible protection that fits how you operate, not a paperwork factory or enterprise tooling you'll never use.

This is the right question to ask, and the answer is no — not without your say-so. Anything that touches a live system is agreed with you first, tested in a safe environment where possible, and backed by a rollback plan.

Offensive testing only ever runs under written authorisation, with clear rules and an agreed stop signal. We design our work to prove risk safely, not to break things.

You work directly with the consultant doing the work. Engagements are led by someone holding CISA, CISM, CRISC and CISSP, with DORA Lead Manager, ISO 27001 Lead Implementer and CIPP/E credentials and a background running information security in regulated financial services.

You're not handed off to a junior after the sales call.

Something you can act on — not a report that sits in a folder. Depending on the engagement, that means a prioritised risk register, a clear remediation roadmap, validated findings with evidence, working policies your team will actually follow, or audit-ready documentation.

Everything is ranked so you know what to do first and why. The point is improvement you can see, not a clean bill of health you can't use.

Yes. AI tools and assistants bring new risks — data leaking into a vendor's model, over-broad permissions, unclear regulatory footing. We assess AI tools before you adopt them, review how AI systems are deployed in your environment, and help you put simple governance in place so staff can use AI safely without guesswork.

It's a growing part of what we do.

There's no single price, because there's no single version of this work. Cost depends on your size, your risk, and what you actually need — a one-off assessment is a very different commitment from an ongoing partnership. What we don't do is sell a fixed package you may not need or quote a number before we understand your situation.

The honest answer is that it starts with a conversation: a free initial assessment where we look at where you stand and tell you what we'd prioritise — and roughly what that would take — whether or not you work with us next.