Retainers
Every deliverable, by tier.
Each tier includes everything in the one before it. The table below breaks out exactly what that means, service by service, so you can see where a given deliverable first appears rather than reading it off a short bullet list.
Deliverables and day allocations are set on your intro call, so you only pay for what you actually need. Full breakdown below.
| Service | Strategic Oversight From £3,500/mo · 2-3 days | Roadmap Ownership From £8,000/mo · 5-6 days | Fractional Executive From £15,000/mo · 10-12 days |
|---|---|---|---|
| Included from Strategic Oversight | |||
| Quarterly board & exec reportingBoard-legible risk summary translating operational choices into commercial terms. | |||
| Risk register design & maintenanceClear identification, scoring, and prioritisation of your operational gaps. | |||
| Customer questionnaire supportDirect triage and answers for key vendor security questionnaires. | |||
| Named CISO escalationDedicated expert access for urgent buyer questions or unexpected security hurdles. | |||
| Added in Roadmap Ownership | |||
| End-to-end roadmap deliveryComplete accountability for executing security initiatives — we own the outcome, not just the advice. | - | ||
| Certification programme leadershipFull management of ISO 27001, SOC 2, or Cyber Essentials projects through to audit pass. | - | ||
| Active vendor & auditor managementDirect handling of supplier assessments, enterprise customer security calls, and audit discussions. | - | ||
| Policy & control architecturePragmatic drafting and rollout of policies that fit your culture and satisfy assurance requirements. | - | ||
| Added in Fractional Executive | |||
| Investor & M&A diligence representationFrontline leadership for buyer audits, investor reviews, and due diligence checks. | - | - | |
| Regulatory compliance alignmentDedicated governance for complex environments (UK GDPR). | - | - | |
| Incident readiness & crisis managementIncident response plan ownership, executive tabletop exercises, and qualified executive leadership of the response to security events, with technical containment and forensics referred. | - | - | |
| Embedded leadership presenceBoard attendance, audit committee representation, and continuous cross-functional leadership. | - | - | |
| AI governance, included in every tier | |||
| AI GovernanceIncluded at every tier, with scope growing by tier. | AI risk visible in the register and in board reporting. AI questions in customer security questionnaires triaged and answered. | Strategic Oversight, plus tool inventory and shadow AI discovery, acceptable use and approval routes, vendor terms and data flow review. | Roadmap Ownership, plus full regulatory alignment work, ISO 42001 or NIST AI RMF mapping, and representation on AI questions in diligence. |
A standalone AI review is available at any engagement size.
The tiers above serve as baseline models for typical maturity stages. Deliverables, day allocations, and focus areas are fully tailored to your operational requirements identified during our initial alignment call — ensuring you only pay for the exact security leadership your business needs.
Start here
Twenty minutes, and no pitch.
Tell us what is blocked, who is asking, and when they need an answer. If we are not the right people, we will say so and point you to who is.