How long does ISO 27001 certification take?

It depends on the starting point. At a unicorn-status crypto business Thomas Kranz built an information security management system from nothing and the company reached ISO 27001 certification in two months. At a blockchain fintech, ISO 27001:2022 certification came within the first three months.

What does a virtual CISO do?

A virtual or fractional CISO provides senior security leadership without the cost of a full-time executive, including security strategy, risk management, board reporting, supplier and regulator management, and leading certifications such as ISO 27001.

Can you help with DORA, MiCA or NIS2?

Yes. Thomas Kranz has built a single roadmap covering MiCA, DORA, NIS2 and MiFID II for a Europe-wide crypto fintech, and delivered MiCA and DORA registration and NIS2-ready incident management for a blockchain fintech.

Case Studies | Thomas Kranz, Cybersecurity Consultant, CISO

ISO 27001 from nothing in two months, an award-winning security programme and two nation-state attackers caught in hiring

A unicorn crypto firm with no ISMS needed to prove its security. I built one from scratch and took it to ISO 27001 certification in two months, which won the Globee Cybersecurity Consultant of the Year award.

Thomas Kranz14 November 2026Financial services and cryptocurrency, ISO 27001 case study, ISO 27001 in two months, crypto security, ISMS from scratch, CISO case study, nation-state attackers hiring, Globee award, Featured

ISO 27001 in three months and banking licence support for a blockchain fintech

A blockchain fintech needed enterprise security, banking licence evidence in two countries and compliance with new EU rules. ISO 27001:2022 certification came within three months, alongside MiCA and DORA registration.

Thomas Kranz13 November 2026Financial services and cryptocurrency fintech, ISO 27001:2022, DORA compliance, MiCA compliance, NIS2 incident management, banking licence security, crypto fintech CISO, CISO case study, Featured

A regulator-ready security function for a Europe-wide crypto fintech

A regulated crypto fintech faced MiCA, DORA, NIS2 and MiFID II at once. I built one two-year roadmap to ISO 27001 that supports every requirement, and a security function that stands up to regulators.

Thomas Kranz12 November 2026Financial services and cryptocurrency fintech, MiCA, DORA, NIS2, MiFID II, ISO 27001 roadmap, regulatory compliance CISO, crypto fintech, Featured

Security strategy and a regulatory licence for a venture-backed crypto exchange

A venture-backed crypto exchange start-up had to satisfy a regulator, insurers and investors at once. I wrote the security strategy and worked with the regulator to win its licence.

Thomas Kranz11 November 2026Financial services and cryptocurrency exchange, crypto exchange licence, security strategy, start-up CISO, regulator engagement, penetration testing programme, virtual asset licence, CISO case study

GDPR-compliant data governance and ISO 27001 for an FCA-regulated business

An FCA-regulated business needed security that met ISO 27001 and PSD2 and stayed on the right side of GDPR. I built the framework, moved it to the updated ISO standard and delivered its DPIAs.

Thomas Kranz10 November 2026Financial services, GDPR compliance, ISO 27001 transition, FCA regulated, PSD2, DPIA, data governance, CISO and DPO

Security due diligence and virtual CISO support for private equity portfolios

Private equity firms need to know what cyber risk they are buying. I carried out pre-acquisition security due diligence, then acted as vCISO to portfolio companies, in plain language an investment team can act on.

Thomas Kranz9 November 2026Private equity and technology investment, cybersecurity due diligence, private equity cyber risk, M&A security due diligence, vCISO, portfolio company security, pre-acquisition due diligence, CISO case study, Featured

Security strategy and breach response advice for a fast-growing smart charging company

A fast-growing smart charging company needed a security strategy to match its growth. I set the roadmap, advised on privacy law and audits, and guided the executives through a live breach.

Thomas Kranz8 November 2026Automotive and clean energy technology, security strategy, breach response advice, incident response executives, IoT security, scale-up CISO, EV charging security, data privacy compliance

A vulnerability management transformation that helped win a nine-figure contract extension

A global manufacturer needed to transform how it found and fixed vulnerabilities. I led the vulnerability management workstream, and the C-suite workshops I ran helped win a major contract extension.

Thomas Kranz7 November 2026IT services and global manufacturing, vulnerability management, security transformation programme, global manufacturing security, security architecture, C-suite security workshops, managed IT services, consulting case study, Featured

Building an award-winning cyber R&D lab and growing a consulting practice by 160%

A fast-growing consultancy wanted a distinctive cyber offering. With a £1 million budget I built an award-winning R&D lab, created a new business unit and grew the practice headcount by 160% in 18 months.

Thomas Kranz6 November 2026Technology consulting, cyber practice growth, cyber R&D lab, go-to-market strategy, security consulting business, cyber hiring, incident response practice, consulting case study

Virtual CISO services and thought leadership across Europe, the Middle East and Africa

Many organisations need senior security leadership without a full-time CISO. I deliver vCISO services, strategy, roadmaps and policy across EMEA, and write and speak on security and AI in plain language.

Thomas Kranz5 November 2026Cybersecurity consulting and publishing, virtual CISO, fractional CISO, vCISO services EMEA, cybersecurity strategy, security policy, AI in cybersecurity, cybersecurity author

More than £5 million of new business, £2 million saved and an 18-month security audit, early in my career

Before moving into CISO roles, I helped win more than £5 million of new cloud business, saved a financial services firm £2 million and led an 18-month security audit of its whole web estate.