Method
How we work.
We are a boutique. That word is overused — here is what it actually means in practice.
Six principles
What we believe and how we behave.
- 01
Senior practitioners only.
No bench warmers. No junior staff billed at senior rates. Every engagement is led by someone with at least fifteen years in cyber, AI or compliance — and our specialists have the certifications and scars to prove it.
- 02
Cyber security is the core. Everything else is built around it.
AI engineering, GRC, ISO frameworks, NIS2 and DORA all rest on the same foundation: control, evidence and audit trail. We do not sell consulting that ignores those fundamentals.
- 03
Lean overhead. Honest pricing.
We have no oversized office, no rotating account managers, no internal partner pyramid to feed. That is why we can deliver work that competes with Big 4 quality at a fraction of the price.
- 04
Fixed-fee where it makes sense.
For implementations and assessments with definable scope, we quote fixed fees. You know what you are getting and what it costs before we start. Time-and-materials is reserved for genuine R&D and ongoing retainers.
- 05
Compliance by design, not by retrofit.
DPIAs, risk registers, evidence packs, audit trails — these are not artefacts we add at the end. They are designed in from week one, because that is the only way they actually work.
- 06
Independent. No vendor lock-in.
We do not resell tools we cannot defend. We do not take kickbacks. When we recommend a platform — Vanta, Drata, AWS Bedrock, Mosyle, anything — it is because it is the right fit for you, not for our commission.
The cadence
Discovery. Design. Delivery. Support.
Every engagement follows the same four-stage cadence. Each stage produces a tangible artefact and a clear go / no-go decision before the next stage begins. No surprises, no scope drift.
- 1
Discovery
Understand current state, regulatory constraints and business objectives. We meet your team, read your documents, look at your systems where appropriate, and produce a scoping memo with a prioritised roadmap.
Output: Scoping memo + prioritised roadmap
- 2
Design
Architecture, data model, security controls, integration points — agreed with your stakeholders before a single line of code is written or a single policy issued. Where compliance is in scope, the DPIA and risk treatment plan land here.
Output: Solution design + risk treatment plan
- 3
Delivery
Iterative build with weekly checkpoints, structured user acceptance testing and a documented handover. For implementations, we go-live in production. For assessments, we deliver the report and the remediation plan.
Output: Working system / Final report + handover pack
- 4
Support
Optional ongoing retainer covering enhancements, regulatory updates, surveillance audits and operational support. Many of our clients prefer a quarterly checkpoint rather than a continuous engagement — we accommodate either.
Output: Continuous compliance + quarterly review
What we do not do
Knowing the difference matters.
We are clear about who we are and who we are not. If any of the below sounds like what you need, you are better served by a different kind of provider.
- — We do not run multi-year transformation programmes with armies of consultants. That is not who we are.
- — We do not deliver "AI strategy" decks without working code or measurable outcomes behind them.
- — We do not sell software licences as a primary revenue line. We are vendor-agnostic.
- — We do not staff junior consultants on critical cyber work. There are no learning seats on your engagement.
- — We do not promise compliance without rigour. If we say you are ready, you are ready.
Ready to discuss your project?
Tell us what you are working on, what is bothering you, and what success looks like. We will reply within two working days.