Practice areas

Six areas of senior, independent advice.

Each practice area starts from a decision or obligation you are facing and ends in something you can act on, from an independent risk opinion to a governed transformation.

Get in touch See our engagements

Where to start

Find the situation closest to yours.

A go-live, exception, or new service needs an independent risk opinion before you sign it off.Cyber Risk and Security Assurance Your board needs to show how it oversees cyber risk, and who is accountable for what.Cybersecurity Governance and Board Advisory An attacker inside your network could reach far more than they should.Zero Trust Strategy and Transformation NIS2, DORA, or the Cyber Resilience Act applies to you, and you need to know what to do first.Regulatory Cyber Resilience Your cloud estate is growing faster than the controls and ownership around it.Cloud and Digital Security Governance AI use is spreading through the business, and the board cannot see what it is doing.AI Governance and Transformation

Cyber Risk and Security Assurance

Security decisions you can defend.

Independent risk assessments, security opinions, and architecture assurance that end in a decision, either to proceed, to proceed with conditions, or not to proceed.

Explore the practice area

Engagements

Case study · A central banking institution in the EUDefensible go-live decisions across 50 servicesDefensible go-live decisions: security governance for market-sensitive services at a central banking institution in the EURead the case study

Cybersecurity Governance and Board Advisory

Cyber security as a governed business risk.

Governance frameworks, board reviews, executive exercises, and reporting for management bodies now personally accountable for cyber risk.

Explore the practice area

Engagements

Case study · Bauer Media GroupAccountability clarifiedOne view for the board: cyber governance across a decentralised media groupRead the case study

Zero Trust Strategy and Transformation

Zero Trust as a practical transformation.

Maturity assessment, strategy and roadmap, architecture, and programme governance that turn Zero Trust principles into changed access behaviour.

Explore the practice area

Engagements

Case study · MeggittReduced reachable attack surfaceShrinking the blast radius: segmentation and access governance in a high-consequence environmentRead the case study

Regulatory Cyber Resilience

Turn cyber regulation into an operating model.

NIS2, DORA, the Cyber Resilience Act, and the UK's Cyber Security and Resilience Bill translated into one control framework, one body of evidence, and one operating model.

Explore the practice area

Engagements

Case study · EU-headquartered, multinational logistics clientProgramme readiness establishedScope before commitment: a NIS2 diagnostic across a multinational logistics groupRead the case study

Cloud and Digital Security Governance

Govern cloud and digital change without slowing delivery.

Cloud security governance, secure adoption, and DevSecOps governance that keep pace with delivery.

Explore the practice area

Engagements

Case study · Bauer Media GroupCompliance moved from 62% to 98%Continuous governance at scale: a shared AWS landing zone for Bauer Media Group's UK, German and Polish estateRead the case study

AI Governance and Transformation

Scale AI use without losing control.

A secure foundation, delivery process, operations, and governance for scaling AI use safely, independent of model or cloud provider.

Explore the practice area

Engagements

Case study · EU-headquartered, multinational logistics client25 AI initiatives brought under one governed routeOne route from idea to production: an AI factory for a multinational logistics groupRead the case study

We apply these practice areas across nine sectors, from financial services and the public sector to energy, healthcare, and logistics.

See the sectors

Not sure which practice area fits? Tell us the decision in front of you.

Send an enquiry See our engagements