For CEOs, boards, and senior leaders who want a second opinion that isn't selling anything
An adviser for the executive who has to decide, not the team that has to implement
Most of the security advice a CEO gets comes from someone with something to sell: a vendor, a consultancy with a practice to fill, or an internal team with a budget to defend. That's not dishonesty; it's structure. What's usually missing is one person with no product, no team, and no stake in the answer, who's been inside enough breaches and boardrooms to tell you what matters and what doesn't. That's the advisory relationship I offer, and I keep it small enough to be honest.
What it covers
The decisions that land on the executive's desk and can't be delegated: whether the security leader you have is the one you need; whether the budget is the right shape; what the board should be told, and how, after an incident or before an AI deployment; whether to pay a ransom and who decides; whether the insurance will respond; what a regulator or a plaintiff would ask; and which of the things you're being told to worry about actually deserve it. I've written about several of these in the executive pages, including what the board should ask the CISO and where personal liability actually sits.
How it works
A standing arrangement, a few hours a month with a phone that gets answered when something happens, or a defined piece of work: a second opinion on an assessment, preparation for a board meeting, an independent view during an incident. Everything in confidence, everything in writing when you want it in writing, and no recommendation I wouldn't defend in front of your auditor.
What it isn't
It isn't a fractional CISO; I'm advising you, not running the function. It isn't an assessment, though I'll tell you when you need one and how to read it. And it isn't reassurance. If you want to be told it's fine, there are cheaper ways.
Where this comes from
Thirty years of leading security, about twenty hands-on in incident response, a PhD centred on cybersecurity, AI, and the criminal use of technology, and a long run of advising boards and executives in organisations from startups to governments. Most of that work is under NDA. What I can say here, I do.
What I've written on this.
Read these before we talk, if you like. They're the long version of the argument.
- Research Your Board Needs a Decision, Not Another Security Dashboard
- Research How Can a Board Verify That Cyber Risk Is Improving?
- Research Should You Buy a New Security Tool or Improve the Controls You Have?
- Short What should the board ask the CISO? Seven questions that get real answers
- Short Can executives and directors be held personally liable for a data breach?
- Short Will our cyber insurance actually pay? What to check before renewal
Related work.
Other ways I'm engaged on the same problems.
- A fractional CISO who sets the rules and takes the hard callsSenior security leadership on a part-time basis: direction, the hard decisions, the board, and the questionnaires, with a capable person of yours running the day to day.
- Hire a CISO who's run the response, not just reported on itA security leader who's led breaches, built operations, and briefed boards. Here's what I'd bring to the role and where I wouldn't fit.
- Hire a cybersecurity director who builds the operation, not the slide about itDirector-level leadership for security operations, engineering, or programmes, from someone who's done the work the team does.
- For recruiters and search firms: what I'm a fit for, and what I'm notA straight answer for search firms: roles, fit, non-fit, and how to get a fast yes or no from me.
Discuss an executive role.
Tell me about the role, the organisation, and what the first year has to deliver. I'll say quickly whether it's a fit.
Much of what I've done can't be described in public, and I've had an intimate relationship with NDAs most of my adult life. What I can say here, I do; the rest we talk about in confidence.
- CEOs and COOs who want an independent security voice they can call before deciding.
- Boards and audit committees seeking an adviser with no stake in the answer.
- Founders and investors facing a security decision that will outlast the people recommending it.