Independent cyber and AI governance
Evidence that your board is doing its job
UK boards are increasingly asked to show — by insurers, by customers, by regulators, and by each other — that they took cyber and privacy risk seriously. Not that they were lucky. That they looked. We produce that evidence.
AI deployment review
An AI assistant does not break your file permissions. It inherits every one you got wrong, and turns a decade of quiet oversharing into something anyone can find by asking a question in plain English.
- What your deployment would actually expose
- The policy and oversight you need around it
- Whether the automated decision rules in the Data (Use and Access) Act 2025 reach you
- A written report and a one-page board summary
From £3,200 + VATFixed scope
How it works and what you receive →Board and executive governance sessions
A facilitated half-day with your board, and the evidence pack that records it. Boards do not buy training. They buy the ability to show, afterwards, that they exercised oversight.
- A scenario chosen for your organisation
- Who attended, what was rehearsed, on what date
- Suggested wording for the minutes
- A prioritised list of what to fix
From £2,400 + VATHalf a day
How it works and what you receive →Board simulation and tabletop exercises
Find out what your people do before it matters. A tabletop exercise against a scenario built for your business. Nothing goes near your live systems — this tests decisions, not firewalls.
- Who declares the incident, who calls the customers
- When the 72-hour clock to the ICO starts
- What happens when the leak came from an AI system
- A written record of where the plan broke
From £2,650 + VATHalf a day
How it works and what you receive →Virtual CISO and virtual DPO
Senior security judgement without the hire. Most UK organisations under a few hundred people cannot justify a full-time CISO and do not need one. They need someone accountable.
- We own your risk register
- Controls, policies and incident readiness
- The security questionnaires your customers send
- The quarterly report your board actually reads
From £3,000 + VATPer month, six-month minimum
How it works and what you receive →Independent assessment
An evidence-based review against a defined set of controls, producing a dated report you can hand to a customer, an insurer or your board.
- Not an accredited certification — and we say so
- We are not a certification body and do not pretend to be
- Need a recognised mark? We get you ready and introduce you
- Never sold to an organisation we have advised
Typically £3,200–£4,800 + VATPriced on scope
How it works and what you receive →NHS: CAF-aligned DSPT
Independent work against the Data Security and Protection Toolkit: the CAF-aligned version for trusts, integrated care boards and commissioning support units, and the standards-based version for the suppliers who hold their data.
- Where you stand against each outcome, before you submit
- The evidence each outcome actually needs, and what is missing
- Findings ordered by what to fix before the 30 June deadline
- A report your SIRO can sign against
Priced on scopeFixed fee agreed before we start
How it works and what you receive →Also available
Bounded pieces of work, priced up front
Cyber-insurance renewal evidence review
Insurance applications are usually completed from memory, under time pressure, by somebody who will not be the person asked to prove the answers later. We check each declaration against the evidence before the form goes in, and produce a one-page sign-off recording what the evidence showed and what was not tested. Under the Insurance Act 2015 a breach of the duty of fair presentation can cost you the policy from inception, and it does not have to be deliberate.
We do not place insurance and we do not sell the fix. Book it thirty to sixty days before renewal, while you still have a choice.
£795 + VAT one application, fixed price · what the review covers →
Third-party and AI vendor due diligence
Most companies have nobody qualified to read a supplier's security answers, and nobody who enjoys asking the questions. We do it for you: evidence checked rather than taken on trust, and a written recommendation your risk committee can act on. PRA Supervisory Statement SS2/21 has required this of regulated firms since March 2022, and FCA SYSC 8 applies alongside it. We pay particular attention to AI vendors, where the question is not only whether they are secure, but what they do with what you give them.
We do not review a vendor we have advised.
From £1,295 + VAT per vendor, or £4,995 + VAT for five
Exposure & Trust Monitor
Cyber Essentials proves the controls were there on the day. Nothing tells you what changed since: the certificate that expired, the DMARC record someone edited, the look-alike domain registered last week, the tracker a plugin update added before the cookie banner. Every month we look at what the outside world can see of your organisation — mail records, certificates, the website as a visitor receives it, the public certificate logs — and send a two-page report: what changed, what to fix now, what to fix this month, what to keep watching. Nothing is installed and nothing is logged into.
Independent monitoring, never a certificate. When nothing changed, the report says so. How it works and what you receive →
From £49 + VAT per month, one domain · £99 + VAT for up to three, checked weekly · cancel any time
Cyber on call
For organisations with nobody whose job this is. Start-ups and AI teams are the clearest case: no CISO, no security function, and enterprise customers who send the same questionnaire they send everybody else. You get one named person who learns your business and stays with it, not a rota and not a ticket queue. Draw the hours down on whatever actually comes up: the questionnaire, the investor's diligence pack, a policy someone has asked for, a contract clause you do not like the look of, or an incident where you need a level head on the phone.
One named contact. No retainer, no monthly commitment, no minimum term.
From £1,350 + VAT ten hours, valid six months · £2,400 + VAT for twenty
AI use: staff session
Your people are already using AI. Most organisations have never told them what they may put into it, and have no record of having asked. A half-day session on what staff can and cannot paste into an AI tool, why, and what happens to it afterwards — built around the tools you actually run, not a generic deck. You get the attendance record and a one-page summary your board can minute.
This is training, so we will not then assess you. We say so before you book.
From £1,850 + VAT half a day, up to 30 people
Penetration testing
Delivered by our accredited testing partner, under our contract and our review. You get the technical report, and you get the part that usually goes missing: what it means for your board, what to fix first given everything else on your plate, and an independent check afterwards that the fixes actually landed.
We name our testing partner before you sign.
From £3,995 + VAT scoped per engagement
ISO 27001 UK overlay pack
Eight documents that add the UK layer to any ISO 27001:2022 toolkit — a Statement of Applicability mapped to UK obligations, a populated legal register, and a breach register built around the ICO 72-hour clock and the Article 33(5) record. Documents, not consulting: buy them and use them yourself.
From £245 + VAT
How we stay independent
We never assess our own work,
and never sell the fix for what we assess.
If we have advised you, designed your controls or written your policies, we will not then turn round and assess your organisation and tell the world it passed. An assessment is only worth anything if the person doing it has no stake in the answer.
It costs us work. We think that is the point.
Why boards are asking now
The rules already bite
Since 5 February 2026, significant decisions made with no meaningful human involvement carry duties: notice, a human who can review, and the right to correct the information used.
The UK has no AI Act
There is no single statute to point at. That does not mean no obligations — it means they reach you through data protection law, your sector regulator, and your own duty to show the board looked. That is easy to miss.
Your customers are asking
Security questionnaires and procurement reviews increasingly want evidence of oversight, not assurances. Deals stall where that evidence does not exist.
Directors carry the duty
A duty of care requires demonstrable oversight. The question is never whether the board cared. It is whether the board can show what it looked at.
See what you receive
One-page board report
A complete example of what goes to your board after an assessment: position against all thirty-six controls, the three decisions only the board can take, and what changed since last quarter. One page, because that is what gets read.
Read the sample → SampleVendor due diligence report
A complete example of a third-party review: what the supplier holds and where, findings with ratings, the contract changes we would insist on before signature, and an explicit statement of what we did not do.
Read the sample →Buy the document, not the day rate
The catalogue
Everything below is already written. You can buy any of it without speaking to us — no discovery call, no scoping session, no licence that lapses. Each document names the law it reflects and the date it was last checked.
- 49 documentsISO 27001:2022 ISMS packPolicies, the Statement of Applicability, the risk method, the registers and the internal audit programme — everything the standard asks you to have written down.£795 + VAT
- 8 documentsUK or EU overlayThe national part the international toolkits leave blank. Sold as two separate packs, because the two regimes have diverged.£245 + VAT
- 3 modules, 18 proceduresOperating runbooksIncident response, operations and AI oversight — the steps, the owner of each one, and the evidence each leaves behind.£165 + VAT each · £395 + VAT for three
- 4 documents, 32 controlsAI rollout packA gap analysis, an AI system and agent register, a rollout plan with decision gates, and an automated-decision assessment.£495 + VAT
- 3 scenariosTabletop exercisesCard decks, facilitator’s guides, complications and a decision log an insurer will accept as evidence. The ransomware exercise is free.Free · £145 + VAT for three
- 1 guide, 1 workbookCyber-insurance companionFifteen question areas, what each is really asking, where it usually goes wrong, and the evidence a defensible answer needs.£95 + VAT
Two things make these worth paying for. They are written to UK law rather than translated from an American template — the ICO’s 72-hour clock, the Data (Use and Access) Act 2025 and the Cyber Essentials evidence are already in them. And where the UK and the EU have diverged, we ship the two versions separately rather than merging them into one document that is quietly wrong in both places.
Does your privacy notice still describe your website?
Almost every privacy notice was accurate on the day it was written. Then a plugin was installed, a host added analytics, a chat widget was trialled and forgotten. Nobody updated the notice, because nobody was looking at the site.
We load the site, record every third party, cookie and tracker, and list each line of the notice that no longer matches. The website privacy scan, and what it costs — including the five checks our own site failed when we ran it on ourselves.
Start with a conversation
Most engagements begin with a board session or an AI deployment review, because both are bounded and both produce something the board can act on. There is no charge for the first conversation and no obligation at the end of it.