The Work

Clarity first. Then action that makes sense.

Everything we do fits into three questions. Most organisations need one of them — not all three, and rarely all at once.

Not every organisation needs everything. We meet you where you are.

Assess

Where are we now?

Your real risks, the gaps that matter, and the quick wins hiding in what you already own.

Improve

What should we do next?

Practical improvements where they count, in an order your team can actually work through.

Lead

How do we keep moving?

The expertise, direction and security leadership to keep it going once the project ends.

What does that look like in practice?

It's rarely one big decision that brings people to us. It's a trustee asking something nobody could fully answer. A supplier being breached. A funder sending a security questionnaire. Or simply realising nobody's quite sure what's covered and what isn't.

Usually, it starts with a question your team is already asking.

Assess

"Where do we actually stand?"

Before anything else, an honest picture — what's genuinely at risk, what's already covered, and what deserves attention first.

Where most people start

Cyber Security Health Check

A practical review of where your security actually is, what the real gaps are, and what deserves attention first. We look at what you already own before suggesting anything new — which is usually where the quick wins are hiding.

Not a ninety-page report where everything is marked critical.

What you get

A prioritised action plan — what to fix now, what comes next, and what can genuinely wait
A one-page summary your trustees can actually read
A conversation to walk you through it, not just a document landing in your inbox

Typically 2–3 weeks · Fixed fee
Scoped and priced before you commit

IT Provider Assurance

"Are we actually getting what we pay our IT provider for?"

An independent look at what your IT provider or MSP is contracted to deliver, and what's actually happening — patching, backups, monitoring, admin access, alerting. Not to catch anyone out, but so you know what to ask for. Good providers welcome it.

Cyber Essentials Readiness

"We started Cyber Essentials. Then we got to the firewall question…"

Where you stand against the requirements, what needs closing, and what certification will actually involve. We prepare you and work alongside a certification body.

Improve

"We know roughly what's wrong. Can you help us fix it?"

The work itself — configuring, closing gaps, writing what needs writing. Done with your team or on your behalf, in an order that's actually achievable.

Microsoft 365 Security

"We already pay for Microsoft security. Are we actually using it?"

Most charities own far more security than they've switched on. We review and then configure — Secure Score, identity and Conditional Access, Defender, Intune, email protection, Purview, and SharePoint oversharing.

AI & Copilot Readiness

"Staff are already using AI. We're not sure what that means for us."

AI acceptable use policies, governance frameworks, Copilot readiness and data oversharing review, and shadow AI discovery — finding out what's already in use before it becomes a problem.

Specialist Security Support

"Our team knows what needs doing. They just need extra expertise."

Security architecture reviews, Zero Trust roadmaps, supplier and third-party risk, business impact assessments, incident response plans, tabletop exercises, backup validation, vulnerability management and staff awareness.

Lead

"We need someone senior in the room. Not a full-time hire."

Ongoing direction once the immediate work is done — so security doesn't quietly slide back down the list.

Security Leadership

"We need security leadership. We don't need a full-time hire."

A part-time security manager — sometimes called a virtual CISO. Strategy and roadmaps, cyber risk registers, board and trustee reporting, budget business cases, and the decisions that need someone senior in the room.

Not sure which?

"We're not sure what we need. Can we just talk it through?"

You don't need to know what you need. Most conversations start with someone describing a situation, not selecting a service.

Tell us what's going on

What makes us different

Most consultants stop at the recommendation.

You've probably had this before. Someone reviews your security, hands over a document full of things you should do, and leaves. The report is accurate. It's also the eleventh thing on a list your team has no capacity to work through.

We don't work that way. We'll sit in your tenant and configure Conditional Access. Write the incident response plan and then run the tabletop exercise. Fill in the funder's questionnaire with you. Get you through Cyber Essentials rather than telling you to get through it.

Advice is the easy half. The value is in what actually changes afterwards.

We don't just tell you what to do. We help you get it done.