Three pillars, six engagements, one path to resilience.
Each engagement stands alone — but most clients move through them in sequence within a pillar, from a first board briefing to a multi-year retainer.
Pillar 01
Board & Executive Advisory
Preparing directors and C-suite leaders to govern cyber risk with the rigour they bring to credit and market risk.
Board Cyber Literacy
Briefings, simulations, and ongoing oversight tooling for non-technical directors. Built around the questions an audit committee should be able to answer in plain language.
Enquire about board →Regulatory Liaison
Translation between technical operations and the CBK, BoT, BoU, and NBR cyber and data protection regimes.
Enquire about regulatory →Pillar 02
Cyber Risk & Governance
Quantifying cyber exposure and rehearsing response — so an incident becomes a governance event, not a technical scramble.
Quantitative Risk Assessment
Moving beyond qualitative heatmaps to financial-first risk modelling specific to East African banking, fintech, and SACCO contexts.
Enquire about quantitative →Incident Response Retainer
Pre-positioned response with rehearsed C-suite playbooks. Out-of-band communications, ransom posture, and recovery cadence agreed before the incident, not during it.
Enquire about incident →Pillar 03
ISACA-Aligned Training
Practitioner-grade audit and control depth alongside your internal teams — aligned with COBIT and the ISACA IS Audit framework.
Internal Audit Co-source
Technical depth alongside your internal audit function for cyber, cloud, and third-party reviews aligned with COBIT and the ISACA IS Audit framework.
Enquire about internal →Policy & Control Design
Lean, examinable control libraries that survive contact with operations and produce the artefacts examiners now expect quarterly.
Enquire about policy →How we work
A short, anonymised engagement.
Names withheld under NDA. Structure and outcomes representative of the last twelve months of work.
01 · Trigger
A tier-2 commercial bank received a supervisory letter after a peer institution's ransomware incident. The board wanted evidence — not assurance — that a comparable event would be managed as a governance matter, not a technical one.
02 · Diagnostic (weeks 1–3)
Interview cycle with the CIO, CRO, CISO and audit chair. Mapped existing artefacts against CBK guidance and reconciled the delta with the board risk appetite statement.
03 · Board deliverable (week 4)
One board-length briefing (14 pages), one one-page decision tree for ransom posture, one rehearsed out-of-band comms plan, and a quarterly attestation template the audit committee adopted verbatim.
04 · Retainer (ongoing)
Quarterly review of the artefacts, a rehearsed tabletop each half-year, and named contact for the CRO between board cycles.
Working with us
Common questions, answered.
- How do you handle confidentiality?
- Every engagement begins under a mutual NDA. Client identities, incident details, and control artefacts are held in confidence and never disclosed in marketing, references, or public writing without written permission.
- What does a typical engagement look like?
- Most clients start with a scoped briefing or diagnostic (2–6 weeks). About half convert into a quarterly retainer for ongoing board reporting, control review, and regulator liaison. A smaller subset move to embedded incident response retainers.
- How is a retainer billed?
- Fixed monthly fee tied to a defined scope of hours, deliverables, and named contact — not open-ended hourly billing. Scope is reviewed each quarter with the sponsor.
- What happens after I submit an enquiry?
- You'll receive a written response within two working days. If the fit looks right on both sides, we schedule a 30-minute discovery call — no obligation, no pitch — to understand your institution and confirm whether we're the right advisor for this work.
- Do you work outside financial services?
- Occasionally, where the governance context is analogous — regulated fintech, insurance, capital markets, or public-sector treasury. Our default focus stays with banks, SACCOs, and microfinance in East Africa.
Start with a single conversation.
We accept a small number of new engagements each quarter. Send a brief note about your institution and we'll respond within two working days.
Request a Briefing