Working together · Engagements
How engagements work
Every engagement starts the same way: a conversation, a short diagnosis and a written proposal. No long sales cycle, no pressure, and nothing you have to sign before you know exactly what you will get.
The process
Five steps, no surprises
A conversation
Thirty minutes to an hour, by video or in person. We ask about your firm, your regulators, your systems and what prompted you to get in touch. You will get a straight answer on whether we can help.
A short diagnosis
With read-only access, we review identity, access and governance against the five gaps we see most often, using what you already have in place. You receive a short written summary of what we found.
A written proposal
A recommendation for Foundation, Advisory or a defined piece of work, with exactly what is included, how we will work together and what it costs.
Onboarding
We agree access, contacts and a reporting rhythm, and record the starting position so progress can be measured from day one.
Ongoing work and review
Regular working sessions and reporting. The scope is reviewed whenever your firm, your systems or your regulators change.
Ways of working
Foundation or Advisory?
Both come with the same named accountability. The difference is how much of the work you want us to carry. Firms often start with Foundation and add Advisory later.
| Feature | Foundation | Advisory and vCISO |
|---|---|---|
| Best for | Firms that need their baseline kept in order and proven | Firms that need security leadership at board level |
| Who you deal with | A named practice, accountable for the results | A named fractional CISO who knows your estate |
| Baseline monitoring | Yes, continuous | Yes, or works alongside your existing monitoring |
| Cyber Essentials | Kept current, year after year | Included where needed |
| Risk register and decision trail | – | Yes, kept live |
| Board reporting | – | Yes, in plain language |
| Policies, suppliers and incident readiness | – | Yes |
| Identity and AI expertise | Applied to baseline findings | Applied across the whole plan |
Specialist work in identity and Zero Trust or AI governance can also be scoped as a defined project.
Principles
How we behave as your adviser
Advisory only
We advise and you decide. We do not run your systems, so our professional indemnity cover is set up for advice, in the same way as an accountant or solicitor.
No commissions, no resale
We do not sell products or take referral fees. If we recommend a tool, it is because you need it.
Your records are yours
The risk register, decision log, policies and reports belong to your firm and stay with you if you leave.
Least access
We ask only for the access each piece of work needs, read-only wherever possible, and we record what was granted.
Pricing after diagnosis
We price once we understand your estate and what your regulators expect, so the proposal reflects real work, not a guess.
Start with a conversation
Tell us about your organisation, your regulators and what is worrying you. We will say plainly whether we can help, and how.
Book a conversation