- 6-9 month search and a €150K+ salary plus overhead
- One perspective and real key-person risk
- Months of ramp-up before measurable impact
- A generalist stretched across every topic
- Fixed headcount cost as your needs change
Security advisory & EU compliance
Security Consultancy
Security consultancy for teams that need practical leadership, partner-tailored execution and board-ready decisions without building a large security office from day one.
- Senior, named vCISO
- EU regulatory focus
- Board-ready reporting
EU regulatory readiness
73%Overall posture
- NIS2Risk management & incident reportingOn track
- DORAICT resilience for financial entitiesIn progress
- GDPRData protection & privacy controlsOn track
- EU AI ActAI risk classification & governanceIn progress
- Cyber Resilience ActSecure-by-design for productsGap
- ISO 27001ISMS & control frameworkOn track
Illustrative posture — your assessment produces your own scores.
A smarter way to lead security
The seniority of a CISO, without the full-time hire.
- Senior leadership engaged in days, on a fixed monthly fee
- A whole team's experience with named accountability
- A maturity baseline and roadmap within weeks
- EU regulatory depth: NIS2, DORA, GDPR, AI Act, ISO 27001
- Scale advisory up or down by adjusting the retainer
More than an assessment
We don't hand you a report and walk away.
Every engagement gives leadership a clear baseline, an owned roadmap and a senior partner who stays accountable for the outcome.
A board-ready maturity baseline
NIST CSF 2.0 scoring gives leaders a practical view of current maturity, control gaps and the decisions that need funding or ownership.
A roadmap your team can execute
We turn findings into sequenced work with owners, budget context and dependency mapping so remediation becomes a delivery plan.
Executive security leadership
A vCISO gives you experienced security leadership for risk governance, board reporting, partner decisions and security programme steering.
Framework and partner readiness
Readiness work helps you prepare for ISO 27001, NIS2, GDPR, DORA, CIS Controls and TISAX, plus the partner questionnaires that often arrive before formal audits.
Engagement models
Choose the advisory model that fits your stage
Senior, named security leadership - not a junior team and a template. Scoped to your team, partners and EU regulatory pressure.
Point-in-time
Posture Baseline
A trusted baseline and an owned, prioritized roadmap.
2-3 weeksTypical timeline
Best for
Book a callTeams that need a trusted baseline before budget, audit or board reporting.
Monthly retainer
vCISO Partner Retainer
Ongoing senior security leadership tailored to your team.
OngoingTypical timeline
Best for
Book a callOrganisations that need CISO-level direction without a full-time hire.
Project or retainer
Transformation Partner
A hands-on partner for framework readiness and execution.
8-16 weeksTypical timeline
Best for
Book a callTeams driving ISO 27001, NIS2, TISAX, supplier risk and roadmap delivery.
How we engage
A structured, transparent engagement
Discover the business context
We map critical services, stakeholders, partners, regulatory drivers and the risks leadership already worries about.
OutputBusiness context · Partner map · Threat landscapeAssess controls and maturity
We review governance, architecture, cloud, identity, policies and evidence against a maturity model that makes gaps visible.
OutputControl review · Architecture review · Evidence samplingPrioritise risk and ownership
We convert findings into business risk, clear owners and remediation work your team can sequence.
OutputRisk scoring · Ownership model · Budget viewRun the improvement rhythm
For ongoing advisory, we join the operating cadence with reporting, partner alignment and roadmap steering.
OutputBoard pack · Roadmap steering · Partner coordination
Built for EU regulation
Operating against the frameworks that matter in Europe
We map your controls once and reuse the evidence across overlapping EU frameworks and partner questionnaires — so readiness compounds instead of repeating.
ISO 27001ISMS & controlsNIS2Risk & incident reportingDORAICT resilienceGDPRData protectionEU AI ActAI governanceTISAXAutomotive (VDA ISA)
FAQ
Common questions
A vCISO is an experienced security leader who works with you on a fractional basis. They own strategy, risk governance, roadmap steering, partner decisions and board reporting without requiring a full-time executive hire.
We assess your practices against the six NIST CSF 2.0 functions: Govern, Identify, Protect, Detect, Respond and Recover. The output is a scorecard and heatmap that show strengths, gaps and where to invest next.
Commonly ISO 27001, NIST CSF 2.0, CIS Controls, NIS2, GDPR, DORA and TISAX. We map existing controls once, then reuse the evidence across overlapping frameworks and partner questionnaires.
An audit certifies a point in time against a standard. Our consultancy prepares the organisation before that moment. We assess maturity, prioritise remediation, align owners and provide leadership support. We provide positioning support, not a binding certification guarantee.
Need security leadership you can act on?
We will help you baseline risk, shape the right operating model and build a roadmap that works with your team and partners.