The Challenge
Sometimes the challenge isn't having more security. It's knowing what matters.
You don't need to tackle everything at once. We help you work out what matters most, agree the next sensible steps, and bring in expertise only where it's genuinely needed.
That's usually a shorter conversation than people expect.
One team. Too many moving parts.
Someone in your organisation is holding all of this together — usually alongside a full-time job that isn't cyber security. The problem is rarely a lack of effort. It's that everything arrives marked urgent, and nothing arrives with a running order.
Do now04
- MFA on every account
- Leavers still have access
- Backups never tested
- Admin accounts unprotected
Do next04
- Cyber Essentials renewal
- AI acceptable use
- Supplier security checks
- Incident response plan
Park for later03
- The new SIEM someone suggested
- Full ISO 27001 certification
- Rewriting every policy
Not everything can, or should, be done at once. Most organisations we meet don't need more security. They need someone to put the list in order.
The work behind the mission.
None of this appears in your annual report. All of it keeps your services running.
- Chasing the Cyber Essentials renewalAgain
- Working out who still has access to whatOngoing
- Answering a funder's security questionnaireDue Friday
- Explaining to trustees why it mattersQuarterly
- Checking whether the backups actually workOverdue
- Deciding what to do about staff using AIUnanswered
- Reviewing settings nobody has touched since setup2019
It's real work. It just never gets counted as work.
Most people we speak to aren't behind because they're careless. They're behind because nobody ever gave them the time — or told them which three things actually mattered.
Next
So what do we actually do about it?
How we help — from a first conversation through to the work itself.