Many organisations need senior security leadership without a full-time CISO. I deliver vCISO services, strategy, roadmaps and policy across EMEA, and write and speak on security and AI in plain language.
Read More
Real results from CISO, consulting and advisory work, from a start-up with no security function to a company certified to ISO 27001 in two months.
I have spent more than 30 years in cybersecurity as a CISO, a consultant and an advisor, mostly for growing and regulated companies in fintech, cryptocurrency, financial services and technology. These case studies show what that work looked like in practice, what I did, and what changed as a result.
Client names are confidential, so each case study describes the sector and market the company operated in instead. Each one covers the problem the company had, what I did about it, and the results, with the numbers where I can share them. If one looks like your situation, book a free 30-minute call and we can talk it through.
ISO 27001 from nothing in two months. At a unicorn-status crypto business I built an information security management system from scratch and took the company to certification in two months, which won the Gold Globee® award for Cybersecurity Consultant of the Year 2023. Read the case study
“Tom was a driving force in the company obtaining its ISO 27001 within a record time.”
Results at a glance:
ISO 27001 certification in two months at a crypto unicorn, and in three months at a blockchain fintech
Contributed to successful banking and regulatory licence applications in five jurisdictions (Jersey, Malta, the Netherlands, France and Latvia), and supported an existing FCA authorisation in the UK
One roadmap covering MiCA, DORA, NIS2 and MiFID II for a Europe-wide crypto fintech
A third-party breach blocked in the first 15 days, avoiding a regulatory fine of £80,000
A contract extension worth more than €100 million helped by C-suite workshops at a global manufacturer
Consulting practice headcount up 160% in 18 months
A unicorn crypto firm with no ISMS needed to prove its security. I built one from scratch and took it to ISO 27001 certification in two months, which won the Globee Cybersecurity Consultant of the Year award.
A blockchain fintech needed enterprise security, banking licence evidence in two countries and compliance with new EU rules. ISO 27001:2022 certification came within three months, alongside MiCA and DORA registration.
A regulated crypto fintech faced MiCA, DORA, NIS2 and MiFID II at once. I built one two-year roadmap to ISO 27001 that supports every requirement, and a security function that stands up to regulators.
Private equity firms need to know what cyber risk they are buying. I carried out pre-acquisition security due diligence, then acted as vCISO to portfolio companies, in plain language an investment team can act on.
A global manufacturer needed to transform how it found and fixed vulnerabilities. I led the vulnerability management workstream, and the C-suite workshops I ran helped win a major contract extension.
Many organisations need senior security leadership without a full-time CISO. I deliver vCISO services, strategy, roadmaps and policy across EMEA, and write and speak on security and AI in plain language.
Read More