Advisory

    Cybersecurity leadership for consequential decisions.

    I advise senior leaders in regulated and high-stakes environments — translating complex cybersecurity and technology risk into clear, defensible decisions.

    Engagement / Model

    Three ways to engage

    01

    Cybersecurity leadership

    CISO-as-a-Service / Fractional CISO

    Senior cybersecurity leadership for organisations that need someone accountable for security without building a full internal security function.

    • Cybersecurity strategy and roadmap
    • Board and executive reporting
    • Risk ownership and governance
    • Security programme oversight
    • Vendor and technology strategy
    • Incident readiness
    • Leadership of existing IT/MSP/security providers

    Need ongoing cybersecurity leadership?

    Secure & Scale provides senior cybersecurity leadership, structure and accountability without the cost of building a full internal security function.

    A Cornhill Cyber service founded by Matthew Carr

    Explore Secure & Scale
    02

    Strategic advisory

    Independent advice for boards, investors and senior leaders facing consequential cybersecurity and technology decisions.

    • Board cyber-risk advisory
    • M&A cybersecurity due diligence
    • Independent security reviews
    • Material incident advisory
    • AI and emerging-technology risk
    • Executive and regulatory briefings

    M&A due diligence. Pre-acquisition due diligence that surfaces value-destroying exposure before close — and structures remediation conditions when it does.

    Material incidents. Senior-level engagement when material incidents occur — governance, board and regulatory communication, in coordination with your technical IR providers.

    03

    Specialist security

    Adversary-informed assessment and research where technical depth matters.

    • OT/ICS and cyber-physical security
    • Architecture and segmentation review
    • Adversary-driven threat modelling
    • Targeted technical assessment
    • Security research
    • Critical-infrastructure risk

    Method

    How I work

    01

    Initial conversation

    A confidential call to understand the question you're actually trying to answer — not the question that's easy to scope.

    02

    Engagement design

    Written scope with clear deliverables, time horizon, and what's explicitly out-of-scope. Fixed fee or retainer depending on shape.

    03

    Delivery

    Direct work with you and your team — no sub-contracted juniors, no boilerplate decks. Senior attention end-to-end.

    04

    Ongoing relationship

    Most engagements continue as a quarterly check-in, board cycle, or on-call advisor relationship. Optional, never a default.

    Next

    Start a conversation

    Some problems need ongoing leadership. Others need an independent perspective at the right moment.

    Ongoing cybersecurity leadershipNeed senior ownership of cybersecurity without building an internal security function?Explore Secure & Scale