Consulting
vCISO, security architecture, and senior advisory — embedded in your team. The same people who scope the work deliver it.
Most security advisory ends in a slide deck and a junior team somewhere else. The diagnosis happens at one rate; the remediation happens at another, by people who did not write the diagnosis. By the time the work hits production, the original context is gone — and the people who built the strategy have moved to the next account.
We do not split strategy from delivery. The principal who scopes your engagement is the same person who runs the work — through Falcon, CyberArk, Tenable, Aikido, or your own stack. Recommendations come from operating the systems, not surveying them. That is the only reason the recommendations are worth listening to.
- vCISO
A senior security leader embedded in your executive cadence — board reporting, risk decisions, vendor scrutiny, hire-or-don't conversations. Hours per month, not full-time headcount.
- Security architecture
Identity, endpoint, network, cloud, application, data — drawn as one diagram, not six unrelated initiatives. Architecture you can hand to engineering and audit at the same time.
- GRC strategy
ISO 27001, NIS2, and DORA scoped against the actual business, not the standard. Programmes built on operational evidence rather than policy theatre.
- Identity & PAM design
Privileged access, identity governance, and IAM design for regulated Nordic environments. Architect-level work, principal-led.
- AI advisory
Where AI fits in your security stack — and where it does not. Honest read on agentic SOC, AI pentest, and the Shadow AI policy decisions you cannot put off.
- Outside-in second opinions
A short, expensive look at a strategy that is about to be funded — or a vendor pitch that is about to be signed. You bring the question, we bring the experience.
- 01 Diagnose
Two to four weeks of focused work — interviews with leadership, review of existing documentation, walk-throughs of the consoles your team already runs. We come out with a real picture of maturity and exposure, not a generic checklist.
- 02 Prioritize
A short plan with the actual sequence. What to do first, what to do never, what to stop doing. Built around the budget you have, not the budget a slide deck assumes.
- 03 Embed
vCISO retainers, architecture mandates, or scoped delivery sprints. The named principal stays on the engagement — not a junior handover.
- 04 Hand off
We are not trying to be permanent staff. When the function is mature enough to operate without us, we hand it over and stay on call. That is how the engagement was supposed to end from day one.
- A security strategy you can defend to your board, your auditor, and your engineering team.
- A named senior consultant on retainer — the same one who scoped the work.
- A clear plan for what to build in-house, what to operate with a partner, and what to walk away from.
-
CrowdStrike Falcon platformThe platform we run our 24/7 SOC on — endpoint, identity, cloud, and agentic AI in one stack.
✓ Certified partner -
Aikido AppSec & AI-pentestContinuous application security and AI-driven pentesting.
✓ Certified partner -
Tenable Exposure ManagementVulnerability management across environments — from cloud to OT.
✓ Certified partner -
CyberArk Identity & PAMPrivileged access and identity governance for regulated environments.
✓ Certified partner
What does a vCISO actually do?
Whatever your CISO would do, sized to your business. Board and audit reporting, risk acceptance, security architecture decisions, vendor and tooling decisions, hiring guidance, and the unglamorous work of saying no to bad ideas. Typical engagement is one to four days a month, longer during a programme rollout.
How are you different from a Big Four advisory or a traditional MSSP?
Big Four advisory gives you slide decks and hands the work to a delivery team that did not write them. Traditional MSSPs sell you monitoring contracts and call architecture someone else's problem. We sit between the two: every consultant on the team has hands on a console, and architecture is the same conversation as operations. There is no handoff because there is no separate team.
Can you take over our existing security programme?
Often, yes. We start with a short diagnostic — what is already in place, what is duplicated, what is missing. From there we either embed alongside your team, take over operations entirely on a defined scope, or refer you to a partner if your needs do not match what we do well. We are not trying to win every engagement.
Do you work month-to-month or on fixed scopes?
Both. Most engagements are monthly retainers — vCISO, architecture mandate, or a scoped delivery role — with a clear set of outcomes per quarter. Some are short, fixed-scope sprints: a strategy refresh, a pre-acquisition security review, a board paper. We do not lock customers into long contracts. If we are not adding value, you should be able to walk.
Are you vendor-neutral?
On the platforms we have not built deep practice on, yes. On CrowdStrike, CyberArk, Tenable, and Aikido we have a clear opinion because we operate them daily. The advice we give is shaped by what we have actually run, not by what is on a partner-tier discount this quarter.
What is the smallest engagement you take?
A few days of focused work — a board paper, a vendor review, a second opinion on a strategy already in motion. We do not have a minimum-retainer threshold for the right kind of question. Most relationships start with one of these and grow into something longer.