Security& Resilience
What it covers
How do we keep operating when an attack succeeds?
We connect regulatory requirements such as NIS2 and DORA with a security organisation that works day to day, with clear accountability, an effective ISMS and rehearsed procedures for a crisis. This includes securing AI applications and agents, which create new attack surfaces and new questions about permissions. The result is a transparent level of security, prioritised measures and an organisation that detects incidents, contains them and recovers. Digital sovereignty adds a view of critical provider dependencies and workable exit options.
When companies bring us in
- NIS2 or DORA applies to your organisation, and it is unclear what that means in practice.
- Security policies exist, but a serious incident has never been rehearsed with senior management and business units.
- AI assistants and agents are given access to data and systems before anyone has reviewed their permissions.
From risk to readiness
We structure the work around the six functions of the NIST Cybersecurity Framework 2.0, with governance at the centre. This makes gaps comparable, and measures follow risk rather than the latest threat.
Establish the baseline
We capture critical business processes, systems, service providers and the obligations that apply to you. A maturity profile across the six functions shows where you stand.
Prioritise risks
Threats and vulnerabilities are assessed by their impact on business operations. The outcome is a list of measures in a clear order.
Build governance
Roles, reporting lines and the ISMS are designed so senior management can exercise its accountability. Policies stay short and verifiable.
Rehearse incidents
In exercises with senior management, IT and business units, we work through realistic incidents. Gaps in reporting, decision-making and communication become visible.
Secure recovery
We verify that backups, recovery plans and fallback arrangements actually hold up in a crisis. Tested recovery times replace assumptions.
Services in this area
Explore all servicesCybersecurity & Resilience
Would you be ready for a serious security incident?
- NIS2 and DORA readiness assessment
- Security governance, ISMS and supply-chain security
- Incident exercises and recovery planning
- Cryptography inventory and post-quantum roadmap
AI Security
What can your AI agent access, and who controls it?
- Inventory and threat analysis for AI applications
- Permission model for agents and tool access
- Safeguards against prompt injection and data leakage
- Red teaming and model supply-chain review
Digital Sovereignty
Which dependencies can you afford?
- Dependency map across data, applications and providers
- Sovereignty criteria and architecture guardrails
- Exit strategies and portability requirements
- Requirements for procurement and contracts
