A board-level reading of your cybersecurity posture and operational resilience, in writing, by someone with no security product to sell you.
You have security tooling in place — CrowdStrike, Microsoft Defender, or an equivalent stack — and a team that manages it. What your board doesn’t have is an independent reading of whether that tooling, combined with your actual business continuity and disaster recovery capability, adds up to genuine operational resilience, or just a collection of individually reasonable controls no one has tested together.
That is what this engagement is.
€15,000. Three to four weeks. Delivered in writing, with a presentation to whoever needs to hear it.
Fixed fee. No implementation work. No commissions. No product recommendations influenced by suppliers.
Why clients commission this review
- A board wants independent confirmation that penetration testing coverage is genuinely comprehensive, not just recurring on a vendor’s own recommended cadence.
- NIS2 scope has recently pulled the business into essential or important entity status, and the operational resilience posture has never been checked against it directly.
- A BC/DR plan exists on paper but has never been genuinely tested end to end, and the board wants that gap closed before it becomes an incident.
- Security spend has grown steadily and the board wants confirmation it’s buying genuine resilience, not just tool sprawl.
- A recent incident, at this business or a close peer, has prompted the board to want an independent baseline before the next one.
Who this is for
Boards and risk committees wanting an independent, evidence-based reading of cybersecurity posture and operational resilience together, not as two separate, disconnected conversations.
CTOs and CISOs who want external validation of the current posture before presenting it upward, or before a significant security investment decision.
Who this is not for
Anyone wanting offensive security testing itself. We review the coverage and governance around penetration testing; we don’t perform the testing. That’s a specialist engagement, and we can point you toward firms we’d trust with it.
Anyone wanting security tooling selected or implemented. We identify and recommend; we do not implement.
What you receive
The Review tells you three things in writing: where your cybersecurity and resilience posture genuinely stands, where the priorities are, and what to address first. Five artefacts, delivered together, in plain language.
A scored posture reading. Security controls, penetration testing coverage and governance, and BC/DR capability assessed together, with evidence behind the scoring.
A NIS2 alignment check, where in scope. A specific read against NIS2’s requirements where the business falls under its scope, not a generic security best-practice comparison.
A risk register sorted by business impact. Every material gap identified, ranked by what it would actually mean for the business if exploited or triggered.
A prioritised roadmap. What to address first, second, third, sequenced across the next year.
A board presentation. A one-hour session with your board or risk committee, findings presented, challenged, and discussed in the room.
How the Review runs
Three to four weeks, in four phases: scoping and inventory, interviews and evidence gathering across security, IT operations, and risk functions, synthesis and writing, then presentation and revisions around your board cycle.
Everything is written before it is said. Nothing is presented to your board that you have not read first.
What this is not
A penetration test. Offensive testing is a specialist engagement we review the coverage of, not perform ourselves.
A remediation engagement. We identify and recommend; we do not implement. Ongoing security monitoring or advisory retainer arrangements can be discussed separately if the Review surfaces a need for continued oversight.
Proof
References available on request. Anonymised excerpts from prior reviews available on request.
What happens next
Start a ConversationThirty minutes. We confirm fit, scope, and timing. You decide whether to proceed. No proposal is sent unless you ask for one.