Trusted counsel for the decisions that move budget.
Boards · Committees · Executives
Cyber, AI, and information governance posture. Strategy, not seat-warming.
A decision is sitting on the board agenda and the room doesn't have the right voice in it.
Boards. Audit and risk committees. CEOs, CIOs, CISOs. The people whose decisions actually move budget — and who carry the consequences when the wrong option gets funded.
The engagement starts wherever the decision is: a session before the next board meeting, a fractional appointment inside the leadership rhythm, or counsel on retainer across the year.
Six lines of counsel. One discipline: decisions made, not options mapped.
01
Virtual / fractional CISO
An ex-CISO in your senior leadership rhythm. Standing counsel, board presence, and someone to own the security agenda — without the executive headcount.
02
Board posture assessments
An independent read of organisational security posture, scored against our proprietary maturity index and delivered board-pack ready.
Read the full engagement → 03
AI governance advisory
ISO 42001 strategic positioning and board AI literacy — a governance position taken before the regulator, an auditor, or your largest customer asks for one.
04
Regulatory readiness
APRA CPS 234, the SOCI Act, Privacy Act reforms, EU AI Act exposure. What applies to you, what doesn't, and what to do first.
05
M&A due diligence
Cyber and AI risk, on the deal clock. Findings the deal team can price — not a compliance appendix nobody reads before close.
06
Strategy facilitation
Security strategy, AI strategy, GRC operating model. Facilitated to a decision, not to a workshop output.
Three shapes. Single session through to multi-year.
01 Multi-year
Retainer
Standing counsel on a cadence — board cycles, committee papers, and the questions that come up between meetings.
02 Ongoing · part-time
Fractional appointment
A vCISO inside your leadership rhythm. Senior presence at the table, accountable for the security agenda, part-time by design.
03 Single session – weeks
Fixed-scope advisory
One decision, one deliverable. A due diligence, a readiness review, a facilitated strategy session.
What you take away is the same in every shape: decisions made, not options mapped.
Strategic advisory without discipline becomes anything-we-feel-like-doing — and we'd rather be useful than busy.
Not operational delivery
Running the ISMS — the cadence, the evidence, the reviews — is Operate. Co-sourced, with your nominated owner accountable.
Pillar · Operate → Not control verification
Independent assessment against defined criteria is Verify, and stays there to protect the independence claim.
Pillar · Verify →
Put the right voice in the room.