Picking the right one matters more than what it costs. They solve different problems — ongoing security leadership on one side, defined-scope project work on the other. Most engagements start with a Cyber Health Check.
A retainer engagement gives you a named CISO on your org chart, your security documentation, and your tender responses. Not "an advisor" — a CISO with their name attached, accountable for the outcome.
Retainers are right when you need continuity, not just a deliverable. When the value is in someone owning the security function across months and quarters — driving the roadmap, fronting the board, managing the compliance programme, and being there between sessions when something breaks. We hold a deliberately small number of retainer clients so we can give each of them genuine senior attention.
"You're a small business under 50 staff. Your enterprise customers are starting to ask harder security questions and your insurer wants to know who owns cyber."
Monthly strategy call, quarterly risk review, quarterly executive update, same-day response on tender questions.
"You're 50–200 staff, growing fast, and your customers are pushing you toward ISO 27001 or SOC 2. You need a compliance programme and someone to drive it."
Fortnightly working sessions, monthly board report, quarterly programme review, escalation path during business hours.
"You're 200–1000 staff, often in a regulated sector, and your board wants formal cyber leadership at the executive table. You need someone who can hold the room."
Weekly leadership presence, monthly board reporting, quarterly strategic review, 24/7 incident response engagement and escalation.
"You need near-full-time CISO presence — pre or post incident, during a transformation, or while you're recruiting a permanent hire. Two or three days a week, embedded."
Two to three days per week embedded, daily availability, full executive participation, programme leadership through transition.
Defined scope, defined deliverables, fixed price for fixed scope, no ongoing commitment. When you know what you need and you want it executed by someone senior, with pace.
Packages are right when the engagement has a clear shape — a compliance milestone, a board deliverable, an incident response, a due diligence window. They are not "smaller retainers" — they are different work, with their own logic and their own rhythm.
A productised, 2-week independent posture review that produces real artefacts — a board-ready document that tells you exactly where you stand, where the gaps are, and what to do over the next twelve months. Independent, evidence-based, assessed against NIST CSF 2.0 or the Essential Eight.
Each package has a fixed scope, a defined deliverable, and a clear timeline. We scope, we deliver, we're done.
A formal maturity assessment against the ACSC's eight strategies, with target-state recommendations.
End-to-end preparation for ISO 27001:2022 certification, from scope to Statement of Applicability.
Pre-renewal preparation that materially improves your insurability and the questions you can answer "yes" to.
A working incident response plan, validated through a facilitated executive-level tabletop exercise.
Quarterly board-ready cyber briefings over twelve months — translation, not transmission.
Structured recovery and uplift programme following a breach, near-miss, or significant security event.
Cyber due diligence on a target acquisition — risk-flagged for the deal team, not a 200-page document.
When the work is well-defined but doesn't map to one of the productised packages — a single advisory question, a board workshop, a focused gap assessment — day-based engagement is the cleanest way to scope it.
For single questions, second opinions, or focused advisory calls. The lowest-commitment way to get a senior view on a specific question.
One day of focused expertise — tabletop facilitation, board workshop, framework deep-dive, or scoped advisory session.
Bundled days for engagements with shape but no fixed product — gap assessment, programme design sprint, or focused architecture review.
These are the cross-cutting capabilities applied across both retainers and packages — the substance of the work, irrespective of the engagement shape.
Programme design, board reporting, risk management frameworks
Essential Eight, ISO 27001, SOC 2, APRA CPS 234, PCI DSS
AI governance, model risk, generative AI security posture
Supply chain assurance, third-party assessment, contract security
Response planning, tabletop exercises, post-incident leadership
Security architecture assessment, control gap analysis, hardening
Book a free 30-minute call. No pitch deck, no obligation. We'll talk through your situation and recommend the engagement shape that actually fits — even if that's "you don't need us right now."
Book a Discovery Call