Where governance meets cyber resilience

Yes. Every engagement — including a first exploratory call — sits under a mutual NDA by default. We publish no client names, no case studies with identifying detail, and no logos without written permission. Confidentiality is the practice, not a marketing option.

We don't run penetration tests, deploy tooling, or operate a SOC. We sit with your board, risk committee and executive team on governance, oversight, and regulator-facing evidence. When you need offensive testing or SOC operations, we help you scope the brief and shortlist providers — we do not compete for that work.

Yes. We take no reseller commissions, no referral fees, and hold no exclusive partnerships with security product vendors. Any tool we mention in a briefing is named because it fits your control gap, not because we're paid to name it.

A fit: CROs, CIOs, heads of internal audit, and board risk/audit chairs at East African banks, SACCOs, microfinance groups, PSPs, insurers, and asset managers who need cyber risk translated into governance artefacts. Not a fit: teams looking for the cheapest control checklist, or organisations that want a technical vendor rather than a board-facing advisor.

Most clients start with a single board briefing or a scoped diagnostic — no long-term commitment. If it's useful, we move to a quarterly cadence or a full advisory retainer. If it isn't, you have a briefing document you can still use.