Who we help
Deep sector experience. Open to every business.
We specialise where regulation is strictest, and bring the same senior leadership to any organisation that wants to take security seriously.
Healthcare & biotech
Security leadership for healthcare and life sciences.
A CISO who has run security inside a GxP-regulated, publicly traded biotech, for organisations that handle PHI and answer to hospitals, payers, pharma partners and OCR.
What usually triggers the call
- A hospital or payer has sent a vendor-risk questionnaire, and the contract is waiting on it.
- Your HIPAA risk analysis is overdue, out of date, or was never properly documented.
- A pharma partner or acquirer has started security due diligence.
- A breach at a peer has your board asking whether it could happen here.
How we help
- HIPAA Security Rule risk analysis
- The analysis OCR expects to see, with a risk register and a remediation plan you can hand over.
- Vendor-risk answers that close deals
- Questionnaires answered accurately and quickly, backed by evidence, so procurement stops stalling.
- Incident readiness for PHI
- Response plans and tabletops that cover breach notification under HIPAA/HITECH and state law.
- GxP-aware security
- Controls that respect validated systems and quality processes instead of fighting them.
HIPAAHITECHHITRUSTNIST CSF 2.0SOC 2ISO/IEC 27001GxP
Financial services & fintech
Security leadership for financial services and fintech.
Named, senior security leadership for firms whose customers, insurers and regulators all want the same thing: evidence that someone accountable is in charge.
What usually triggers the call
- An enterprise customer wants a SOC 2 report before signing.
- Your cyber-insurance renewal asks for named security leadership and a tested response plan.
- NYDFS Part 500, the GLBA Safeguards Rule or SEC cyber disclosure has landed on your desk.
- A funding round or acquisition has triggered security due diligence.
How we help
- SOC 2 and ISO 27001 readiness
- Gap assessment, policy set and evidence plan, so the audit finds what you expect it to find.
- Insurer- and regulator-ready documentation
- Programme documents written the way underwriters and examiners read them.
- Board reporting
- Cyber risk explained in business terms, with metrics a board can act on.
- Fraud-resistant operations
- Controls against business email compromise and payment-redirection fraud.
SOC 2NYDFS 23 NYCRR 500GLBA Safeguards RuleSEC cyber disclosureNIST CSF 2.0ISO/IEC 27001
US–EU cross-border
One security practice on both sides of the Atlantic.
For groups with a US parent and an EU subsidiary, or US companies selling into Europe. The assessment, policy set and playbook are written once and mapped to both regimes, not passed between firms.
What usually triggers the call
- You are entering the EU market, or have just acquired an EU entity.
- Someone has asked whether NIS2 applies to you, and nobody is sure.
- HIPAA and GDPR obligations are being handled by two different firms that do not talk.
- Data transfers rely on Standard Contractual Clauses or the Data Privacy Framework, and nobody owns them.
How we help
- NIS2 applicability and gap review
- Whether you are in scope, as an essential or important entity or as a supplier to one, and what that means in practice.
- GDPR security and breach notification
- Art. 32 controls and an Art. 33/34 decision process that works inside 72 hours.
- One policy set, mapped twice
- A single programme mapped to HIPAA, GDPR, NIS2 and ISO 27001, rather than parallel paperwork.
- Cross-border transfer governance
- DPAs, SCCs and transfer assessments kept current, with an owner.
GDPRNIS2ISO/IEC 27001NIST CSF 2.0HIPAAEU–US Data Privacy Framework
Every other industry
Security leadership for organisations of any size, in any industry.
You do not need to be in a regulated sector to need senior security leadership. From family businesses and nonprofits to multinational manufacturers and software companies, every organisation faces the same attackers, and increasingly the same questions from customers, partners and insurers.
What usually triggers the call
- A major customer or partner has asked about your security, and the answer needs to be right.
- Your cyber-insurance renewal is asking questions nobody on the team can answer.
- Security has not kept pace with the business: no clear owner, no tested plan, or a programme that has drifted.
- A ransomware story in the news has leadership asking whether it could happen to you.
How we help
- A clear, prioritised plan
- Where you stand today, what matters most for an organisation like yours, and what to do first, in plain English.
- Customer questionnaires answered
- Security reviews from customers and partners answered properly, so deals keep moving.
- Ready for the bad day
- Backups that restore, a response plan people know, and a number to call.
- Sized to your organisation
- Senior judgement without a full-time hire, or extra senior capacity alongside the security team you already have.
NIST CSF 2.0CIS Controls v8SOC 2ISO/IEC 27001Cyber-insurance requirements
Not sure where you fit?
Tell us what is going on. We will tell you honestly whether we can help.
- Founder-led
- ISACA CISM
- US & EU
- Reply within one business day