A second opinion before a decision. Someone to own the security position for a while. A plan you can fund and a case your board will accept. All three are normal starting points — and all advisory: strategy, planning, and counsel, not delivery.
Counsel at the level decisions are made: the position, the exposure, and the investment case for the people who approve them.
Security leadership on a monthly retainer: ownership of the strategy, and a named senior person to put in front of customers and auditors.
Where AI belongs in the business, what it should never touch, and the governance to agree on before production.
A multi-year direction with sequencing, cost, and dependencies worked out, so the plan survives a budget cycle.
Structuring a program so it can be run and reported on: scope, sequence, milestones, and the governance to keep it honest.
For firms where security posture decides whether you are shortlisted. Positioning the business and shaping the pursuit.
Availability varies, since I take on few clients. You'll get a scope and a number before any work starts. Delivery stays with your team or your providers; I advise the people doing it.
A strategy, a roadmap, a program plan, a board case — fixed price, timeline, and deliverable. Best when you know what you need.
Set hours each month for counsel, reviews, and standing leadership. Best when the need is continuous but doesn't justify a full-time executive.
For when you want a second opinion — a vendor decision, a reorganization, a bid you are unsure about, a board question you would rather not answer alone.
Usually the opposite. The cheapest time to set direction is before there is much to undo — a short engagement at 15 people avoids the scramble at 80, or the one your first enterprise customer triggers.
No, and there are no vendor commissions. If a tool is worth buying you'll hear that; if you already own something that does the job, you'll hear that instead.
Two things. The strategy — where AI genuinely helps, what it must never touch, and in what order to adopt it. And the guardrails — approved tools, permitted data, who signs off, and the exposure when an agent reaches real systems. Most companies need both and have neither written down.
Yes — it's the usual arrangement. Your MSP or internal team does the work; I set the direction, review the decisions, and hold the program to the plan. Being separate from delivery is what makes the review worth having.
Fixed-scope engagements are quoted flat after a scoping call. Retainers are monthly by hour band. Advisory is hourly in prepaid blocks. You'll see the number before any work starts.
No. Implementation stays with your team, your MSP, or a delivery partner — I'll help you pick and brief them. Keeping advice separate from delivery is deliberate: the recommendation isn't shaped by who would be paid to build it.
Yes — yours or mine, before anything sensitive is discussed.
A short conversation is usually enough to work out the right scope — including whether it's smaller than you expected, or not the right fit at all. Get in touch.
