What we are hired to do

Most organisations do not have a technology problem so much as an unwritten technology plan. Spend accumulates through renewals, systems arrive with departments, and nobody holds the whole picture. A strategy engagement puts that picture on paper and turns it into a sequence you can fund.

We start from the commercial plan rather than the technology: what the organisation intends to do over the next one to three years, what would prevent it, and which of those obstacles are technological. Only then do we look at systems, contracts, licence spend and internal capability — and score each against that intent.

The output is a roadmap with cost ranges, dependencies and a stated order of work, plus an explicit list of what we recommend not doing. Boards find the second list at least as useful as the first.

Typical duration

3–5 weeks

Format

Fixed-scope assessment

You receive

Findings report, costed options, sequenced roadmap

Best when

Budget planning, new leadership, or growth outpacing systems

Systems rarely fail at the centre; they fail at the joins. An architecture review maps what is actually deployed, how data moves between systems, and which of those movements depend on a scheduled export, a shared mailbox or one person's spreadsheet.

We document the estate as it is — applications, environments, integrations, authentication, data ownership — and mark each connection with what happens when it breaks. That produces a technical debt register ranked by consequence rather than by age, which is what makes it usable for prioritising work.

Where a redesign is warranted we set out a target architecture and a migration path that keeps the business running while you get there. Where it is not, we say so: many estates need three fixes and a monitoring change, not a rebuild.

Typical duration

2–4 weeks

Format

Fixed-scope assessment

You receive

Architecture and data-flow map, debt register, target design

Best when

Integrations keep breaking, or a rebuild is being proposed

“Move to the cloud” is not a plan, and for some workloads it is not even an improvement. We assess each workload on its own terms: what it costs to run today, what it would cost as a managed service, what the migration itself would cost, and what operational burden each option leaves behind.

Run-cost modelling is the part organisations most often skip and most often regret. We model steady-state spend at realistic usage — including egress, backup, licensing changes and the support time that does not disappear — so that the business case survives its first year.

The recommendation covers sequencing as well as destination: which workload moves first to prove the pattern, what must move together, what should stay where it is, and what should simply be retired.

Typical duration

3–5 weeks

Format

Assessment, optionally followed by oversight

You receive

Workload analysis, cost model, migration plan

Best when

Hardware refresh, datacentre exit, or rising cloud bills

When two departments quote different numbers for the same month, the problem is usually not the reporting tool. We trace each figure back to its source system, document the transformations applied along the way, and identify where definitions diverge — then agree one definition per measure with the people who use it.

From there we look at the manual work surrounding those numbers: the re-keying, the weekly export, the reconciliation that takes a person two days a month. Each candidate is assessed for volume, error cost and stability before anything is automated, because automating an unstable process simply produces errors faster.

Recommendations stay proportionate. Many organisations need a defined data source and two automations, not a warehouse programme — and we will say that even when the larger project would be the more lucrative engagement.

Typical duration

2–4 weeks

Format

Assessment, optionally followed by build support

You receive

Data-source map, measure definitions, automation shortlist

Best when

Numbers disagree, or reporting consumes days each month

Buying software and commissioning a build are both exercises in specifying what you want precisely enough to be able to refuse what you do not. We write and challenge requirements, build weighted evaluation criteria before the demonstrations start, and sit in on those demonstrations asking the questions a buyer often cannot.

For projects already under way we run a delivery health check: scope against contract, progress against plan, quality against the definition of done, and the honest state of the relationship between client and supplier. Findings go to the sponsor in writing, including the ones that are uncomfortable.

We hold no partner relationships with the suppliers we evaluate, and we do not bid for the delivery work we assure. That separation is the whole value of the service.

Typical duration

2–6 weeks, or ongoing oversight

Format

Assessment or project oversight

You receive

Requirements pack, evaluation matrix, or health-check report

Best when

Selecting a supplier, or a project has stopped moving

This is a readiness and advisory service, written in plain English for people who have to make decisions about risk without a security background. We review identity and access, device and patch posture, third-party access, logging, and the backup arrangements — specifically whether a restore has ever been tested end to end.

Resilience is assessed against stated targets: how long the organisation can be down, how much data it can afford to lose, and whether the current arrangements can actually meet those numbers. Where they cannot, the gap is quantified rather than described.

For organisations pursuing Cyber Essentials or answering client security questionnaires, we prepare the evidence and close the gaps beforehand. We are not a certification body, and the certifying assessor remains independent of us.

Typical duration

2–4 weeks

Format

Fixed-scope assessment

You receive

Control review, recovery-gap analysis, prioritised remediation plan

Best when

Client security questionnaires, insurance renewal, or post-incident