Why Us

Security that works. Governance that proves it.

Most organisations end up choosing between someone who can configure the technology and someone who can evidence it to a board. We do both — which is usually the gap that leaves security work half-finished.

The technical side

Getting it right

Hands-on across Microsoft 365, Defender, Sentinel, identity, cloud and hybrid infrastructure. Not advice from the outside — configuration, remediation and the work itself.

The governance side

Proving it

Audit and assurance discipline. What was done, why it was decided, who owns the risk, and whether anything actually improved — ready when trustees, funders or auditors ask.

Why "for Purpose"?

Charities exist to spend their time, energy and money making something better. Cyber security matters because it protects that work — people's information, services, staff, donations, and the trust that holds it all together.

I've worked inside this world. Budgets matter. Resources matter. People already have full-time jobs. Every pound spent on technology has to justify itself against the mission — and most security advice simply isn't written for that.

That's why Cyber for Purpose exists: to make good security achievable where every pound, every person and every hour already has another job to do.

We've done the job, not just advised on itSecurity run day to day inside schools, charities, non-profits and government — with the same constraints you have.
We finish what we startAssessment and implementation from the same people. No handover, no report left to gather dust.
We don't sell productsNo vendor margin, no reseller agreements. If you don't need something, we'll say so.
Proportionate by defaultEvery pound spent on security is a pound not spent on the mission. Recommendations have to earn their place.

Who you'll be working with

The people you meet are the people doing the work.

No salesperson, then an account manager, then a consultant, then a junior analyst. You explain your situation once, to whoever will be dealing with it.

Vikas Mehmi — Security & Technology

I've spent nearly two decades in IT, the last ten in cyber security, across schools, charities, non-profits, government and highly regulated environments. That means I've been the person answering the trustee's question, chasing the Cyber Essentials renewal, and working out what could actually be afforded this year.

Today I work hands-on across Microsoft 365, Defender, Sentinel, identity, cloud and hybrid infrastructure. Sometimes that means supporting an existing IT team. Sometimes it means taking ownership and getting the work done.

Either way the aim is the same: security that fits the organisation you actually are — not the one a textbook assumes you should be.

CISSP
CISM
Microsoft SC-100
ISO 27001 Lead Implementer
SC Cleared

Niti Paul — Assurance & Governance

My background is audit and assurance at a Big Four professional services firm, then a global investment bank, and programme delivery across a range of organisations since. I've spent my career asking the question auditors ask: how do you know?

Improving security isn't only about putting technical controls in place. Organisations also have to show what was done, why decisions were made, who owns the risk, and whether anything actually improved.

That's the structure I bring — keeping programmes moving, strengthening governance, and making sure the evidence is there when trustees, funders or auditors ask the difficult questions.

Audit & Assurance
Programme Delivery
Governance
AI Governance

Who we're probably not right for

Organisations looking for someone to sign off work that hasn't been done, rubber-stamp a decision that's already been made, or deliver an enterprise-scale programme to a small team. Needing a certification because a funder asks for it is perfectly reasonable — wanting the certificate without the work isn't something we can help with. If that's the situation, we'll say so early, and point you somewhere better where we can.

A few things we believe

Not everything needs fixing tomorrow.
Use what you already own before buying more.
Proportionate security beats perfect security that never gets implemented.
A small number of meaningful improvements beats a long list nobody finishes.

The aim isn't to sell you more security. It's to help you make better security decisions.

Spoiler: we're probably not going to recommend buying twelve new security products.

Straight answers

A few honest answers.

How do you manage capacity?

We deliberately keep our client list manageable so the people you meet stay the people doing the work. Project timelines are scoped upfront and stuck to, and for ongoing support we agree response expectations from the start. If we can't take something on, we'll tell you rather than overcommit.

Do you replace our IT provider or MSP?

No. We work alongside them. Your IT provider keeps the lights on — we help make sure the security decisions around that are the right ones.

We don't have Cyber Essentials yet. Is that a problem?

Not at all. Most organisations we speak to are somewhere on that journey — that's exactly what the Health Check and Cyber Essentials support are for.

What if our trustees just want reassurance, not a big project?

Very normal starting point. A Health Check usually gives trustees a clear, honest answer to "are we doing enough?" without committing to anything larger.

Is there a minimum contract?

No minimum for project work — most engagements start as a single fixed-fee piece with a clear scope. Ongoing security leadership runs on a three-month initial term, purely so there's enough time to get somewhere useful, and continues month to month after that.

Where is our data handled?

Mostly, not by us at all — where an engagement involves your systems, we work inside your own tenant rather than copying data out of it. For the website and enquiry emails: we're UK-based and UK-resident, and hosting sits within the UK/EEA. If your funders or contracts require UK-only data residency, tell us and we'll work to that.

Do you work outside the charity sector?

Our focus is charities, non-profits and purpose-led organisations — that's where our experience is most useful. We do also support smaller businesses facing many of the same constraints. If you're not sure whether you fit, just ask.