The article
A security questionnaire from a big client, an audit date, an insurance renewal form full of questions about backups and two-factor sign-in, a board member who asks whether the company is safe: each is a good reason to bring in cybersecurity consulting, and each needs a different first step. This page sorts our eleven consulting services by the situation that brings people to them, so you can start with the right one.
I have been building software for 18 years. Since 2017 my team of 70+ specialists has delivered 150+ projects. Our consultants work next to the engineers who test, watch and fix systems, so a plan we write is one we can also carry out with you.
Cybersecurity consulting: the short version
| What | How it works |
|---|---|
| What we do | Assess where you stand, rank the risks by what they could cost, set the strategy and the rules, and help put them in place |
| Frameworks | NIST CSF, ISO 27001, SOC 2, CIS Controls, HIPAA or PCI DSS: the one your clients and regulators expect |
| Who it fits | A startup facing its first enterprise client, a growing company, an enterprise with many teams and vendors |
| What we do not do | Issue certificates or attestations. An independent auditor or assessor does that |
| Price | An individual estimate before work starts; the first call and the rough estimate are free |
Which consulting service fits your situation
Forward this table to whoever asked for "a security consultant". Find your situation in the first column.
| Your situation | Start with | What you get first |
|---|---|---|
| A client sent a security questionnaire or asks for SOC 2 | Compliance consulting | Which rules apply, the gaps, the evidence an auditor will ask for |
| An audit date is set | Audit consulting | A mock audit against your real systems, then the fixes and the evidence |
| Nobody can say where you stand | Assessment consulting | A score against a framework and a ranked list of gaps |
| The board or the insurer asks about risk | Risk consulting | A risk register: each risk with an owner, its likelihood, its cost and a decision |
| You need a plan and a budget for the coming years | Strategy consulting | A roadmap for one, two and three years, with what each step buys |
| You need a security lead, not a full-time hire | Managed consulting | A monthly review, answers to client questionnaires, current policies, a report for the board |
| Nobody knows what happens on the day of an attack | Incident response consulting | A response plan with roles and contacts, tested in a drill |
| Too many alerts, or no idea what to log | Monitoring consulting | What to watch, which logs to keep and for how long, who answers an alert |
| You run on AWS, Azure or Google Cloud | Cloud consulting | Your accounts, access, networks, data and code pipelines reviewed |
| You run plants, machines or control systems | OT consulting | An inventory, a review of remote access and a roadmap that fits your maintenance windows |
| Your team uses or builds AI | AI consulting | Rules for data in AI tools, prompt injection checked, a log of what agents did |
If two rows fit, start with the one that has a date on it.
What the pages that rank leave out
Before writing this, I read the five consulting pages Google showed for this search in October 2026: two firms' service pages and three firm pages from the local map. All five talk about compliance and incident response. None of them names SOC 2, none says who issues a certificate or an attestation, none mentions the security questionnaires clients send, and none shows a price on the page itself. Five pages are a small sample, but a buyer needs exactly those answers before signing, so they are below.
Who does what: the consultant, the auditor and you
Consulting gets you ready. It does not certify you: the paper comes from someone independent, which is why your clients trust it.
- SOC 2: a report issued by a CPA firm.
- ISO 27001: a certificate from an accredited certification body.
- PCI DSS: a Qualified Security Assessor, or a self-assessment questionnaire.
- HIPAA: there is no official certification; HHS does not certify anyone. Ask your compliance advisor what your organization has to document.
Our part comes before and around the audit. Cybersecurity audit consulting starts with a mock audit, closes the gaps it finds, gathers the evidence and stays with you while the real audit runs. Your part is the decisions: which risks to accept, which policies to adopt, who owns what.
Cybersecurity GRC consulting, in plain words
GRC stands for governance, risk and compliance. Cybersecurity GRC consulting turns the three into a few documents your team actually uses:
- Governance: who owns security and how decisions are made. In cybersecurity governance consulting this comes first, and NIST made it part of the framework itself when version 2.0 of its Cybersecurity Framework added a Govern function in February 2024.
- Risk: what could go wrong, how likely and how costly. Cybersecurity risk consulting checks each rating against vulnerability scans and tests of your systems, so the plan goes after weaknesses an attacker could really use.
- Compliance: the rules you must meet and the proof they ask for.
- Policies your team can follow, short enough to read, not a binder nobody opens.
How an engagement goes
Every engagement runs in four steps: interviews about the business, its systems and what worries you; an assessment against a recognized framework, gap by gap; a roadmap of what to do first, next and later, with owners and costs; and help putting it in place, with a review as the company changes. From you: the people who know the systems, access to documents and settings, and someone who can decide.
The stage of the company changes the content. Cyber security strategy consulting decides what to protect first and what it is worth spending. For a startup, it begins with the controls the first enterprise clients will ask about, without slowing the product; for an enterprise, it ties many teams, vendors and rules into one plan. For a small company with no security staff, a good yardstick is the first implementation group of the CIS Controls: 56 safeguards that CIS calls essential cyber hygiene.
Consulting that does not stop at a report
A report is half the job. Our consultants sit next to the engineers who make the fixes, so findings turn into cybersecurity remediation: code patched, servers hardened, settings corrected and tested again to prove the hole is closed.
Sometimes compliance becomes a feature of the software itself. RxPhoto, a clinic photo platform we worked on, keeps an audit log of every user action, so administrators can show who opened which patient record and when. That is the kind of evidence an auditor asks to see. For PBM Source we delivered the other side of compliance: software in which every new law or regulation for pharmacy benefit managers arrives as a task with a summary, a jurisdiction and a date.
Red flags when you choose a firm
Whichever cyber security consulting firm you talk to, these are reasons to keep looking:
- A promise of a certificate. A consultant cannot issue one.
- A fixed price for "compliance" quoted before anyone has asked what you run.
- Savings promised in dollars before anyone has looked at your systems.
- A framework chosen before anyone asked who your clients and regulators are.
- A report with a hundred findings in no order, and nobody who can fix them.
- Policies copied from a template, with another company's name still inside.
What the price depends on
Cybersecurity consulting is estimated before work starts, and the first call and the rough estimate are free. The estimate follows how many systems, people and locations there are; which frameworks, and how many at once; whether an audit needs months of records, which some controls do before an auditor accepts them; and whether you need one project or a security lead every month.
Tell us what is on your mind: the questionnaire, the audit date or the worry. We reply with where we would start and a rough estimate, free. The services that carry out the plan, from testing to monitoring, are on our cybersecurity page.
