Services
Senior-led engagements for the risks boards are asking about now.
Fixed-scope assessments when you need an answer. Retained leadership when you need an owner. Every engagement is scoped, led and delivered by a senior practitioner with Tier 1 experience.
01 · 4 services
AI & Agent Assurance
Find, test and control the agents and identities acting on your behalf.
AI Agent Access Review
An independent review of every agent, service account and token acting on your behalf — who owns it, what it can reach, and whether it should.
Explore AI Agent Access ReviewAgentic AI Security Assessment & Red Teaming
Adversarial testing of your agents and the tools they call — prompt injection, tool abuse, privilege escalation and exfiltration paths.
Explore Agentic AI Security Assessment & Red TeamingIdentity & Privileged Access Assurance
Joiner–mover–leaver, PAM and non-human identity controls, tested against how attackers — and agents — actually move.
Explore Identity & Privileged Access AssuranceAI-Incident Tabletop Exercises
Executive and operational exercises built around a rogue or compromised agent. Find the gaps before an incident — or a regulator — does.
Explore AI-Incident Tabletop Exercises02 · 3 services
Governance & Regulation
Turn overlapping regimes into one coherent, evidenced control story.
AI Governance, ISO/IEC 42001 & EU AI Act Readiness
An AI management system your auditors, regulators and board can follow, mapped to ISO/IEC 42001 and the EU AI Act.
Explore AI Governance, ISO/IEC 42001 & EU AI Act ReadinessCyber Security and Resilience Bill Readiness
For managed service providers and critical suppliers — scope, incident reporting, supply-chain duties and the evidence to prove them.
Explore Cyber Security and Resilience Bill ReadinessRegulatory Resilience & Control Assurance
DORA, GovAssure/CAF, CBEST, TIBER-EU, FedRAMP and ISO 27001 — assurance against the frameworks your regulators actually test.
Explore Regulatory Resilience & Control Assurance03 · 1 service
Quantum
Discovery and migration planning ahead of the NCSC’s 2028 milestone.
04 · 4 services
Leadership
Senior accountability — retained, advisory or in the boardroom.
vCISO for AI
A senior CISO on a retained basis, accountable to your board — with AI and agent risk built in from day one.
Explore vCISO for AIBoard AI Risk Briefing & Director Training
Separate AI as a threat, AI to govern and AI you use — so directors can challenge with confidence.
Explore Board AI Risk Briefing & Director TrainingSecurity Strategy & Architecture Review
Strategy, target operating model and architecture review — zero trust, cryptographic posture, cloud — built into a board-ready investment case.
Explore Security Strategy & Architecture ReviewAdvisory & Mentoring
Peer-level counsel for CISOs and executives through live decisions — a relationship, not a curriculum.
Explore Advisory & MentoringEngagement models
However you engage, the senior person stays accountable.
- Retained An ongoing relationship with programme oversight, board reporting and a named senior leader.
- Project A defined scope and outcome — an assessment, a roadmap, an exercise or a compliance milestone.
- Advisory Flexible access to senior counsel when you need judgement, not a formal engagement.
Regulatory & assurance coverage
The frameworks your regulators and customers actually test.
- DORA
- EU operational resilience for financial services
- GovAssure / CAF 4.0
- UK government and CNI cyber assurance
- CBEST & TIBER-EU
- Threat-led testing for systemically important firms
- FedRAMP Rev5 / 20x
- US federal authorisation for cloud providers
- NIST SP 800-53
- Security control catalogue underpinning FedRAMP
- ISO/IEC 27001
- Information security management
- ISO/IEC 42001
- AI management systems
- EU AI Act
- Risk-based obligations for AI providers and deployers
- Cyber Security and Resilience Bill
- UK NIS reform: MSPs, data centres, critical suppliers
- NCSC PQC timeline
- Discovery by 2028, priority migration by 2031, complete by 2035
Not sure where to start?
Take the five-tollgate diagnostic for an honest picture of your agent controls — or talk to us directly. Either way, a senior practitioner will respond.