The question is no longer whether you are secure. It is whether you can show it
Security stopped being an internal matter the moment customers, insurers and acquirers began asking for evidence. This practice takes it on as what it has become, a commercial obligation with other people's deadlines attached, across posture, the build pipeline, third-party exposure and what actually happens in the first hour of an incident.
You are already being audited, and not by a regulator
Most businesses between scale-up and mid-cap meet their own security posture through somebody else's paperwork. A customer sends two hundred questions before they will renew. An insurer wants to know what changed since last year, and prices the answer. An acquirer's diligence team asks for the access review, the incident log and the penetration test that was meant to be annual.
None of that is an attack. It is the ordinary cost of trading, and it arrives whether or not anything has ever gone wrong. The breach is the tail risk: genuine, expensive, and possibly never. The assurance burden is the standing one, and it is the one that stalls deals in security review, hardens renewal terms and quietly reprices transactions.
What makes it expensive is rarely the controls themselves. It is that no one owns the evidence. The answers exist, scattered across an MSP, a policy folder and two people's memories, and assembling them costs a fortnight of senior time every time somebody asks.
Four kinds of work, all of them about evidence
Each of these is a governance judgement before it is a technical one, which is why they sit at board level rather than inside an IT team or an MSP contract.
Posture, and the evidence behind it
Where the controls actually are, as against where the policy says they are, and what you can put in front of somebody who asks. Certification follows from that work rather than driving it. A framework earned to pass an audit decays back into the gap it was bought to close.
DevSecOps, done as a precision problem
Security as a property of how software gets built rather than a gate in front of release. The hard part is not the tooling and never was; it is signal against noise, and getting that wrong is how most of these programmes fail. The evidence is below.
Third-party and supply chain exposure
Your suppliers' security is now part of yours, contractually and in practice, and the questionnaire you send is not the same thing as knowing. Where that turns into a commercial question, covering concentration, exit terms and what a vendor actually committed to, it meets the procurement practice head on.
Incident readiness, tested rather than written
Who decides at two in the morning, who calls the regulator and inside what window, who talks to customers, and whether any of that has been run rather than filed. A plan nobody has rehearsed is a document, and it will be read for the first time on the worst day.
Sometimes the certificate is the whole answer
A good deal of what gets sold as a security programme is a certification project with a larger budget attached. Occasionally the certificate genuinely is the requirement: a customer needs to see ISO 27001, nothing about the risk profile argues otherwise, and the honest scope is a fraction of what we would otherwise propose. Where that is true we will say so, and we will say it before the proposal rather than after.
We also take no commission on security tooling and do not resell it. Where a control genuinely needs a product, the recommendation has to survive one question: what do we get if you buy it? The answer has to be nothing.
An evidence position, before a roadmap
Engagements here usually open by establishing what you could actually demonstrate today, to the three audiences that will ask: a customer's security review, an insurer at renewal, and a regulator or acquirer who wants the record rather than the intention.
That means four things. What controls are genuinely operating, and how you would prove it. Which obligations already apply to you, and which are arriving with the UK Cyber Security and Resilience Bill. Where third-party exposure concentrates. And whether the incident plan has ever been run by the people who would have to run it.
The output is a ranked view of exposure and the evidence gaps behind it, which is usually enough for a board to act on, and occasionally enough to decide that no programme is required.
Seven areas, scored out of five. Assess only the areas that apply, since secure delivery is genuinely irrelevant if you build no software. See your rating on screen, and take the detailed PDF if you want it.
Shifting security left is near-consensus, and it keeps going wrong
In CloudBees' global C-suite survey, 83% of executives said shifting security left mattered to their organisation and 58% said it was a burden on their developers, the same respondents agreeing with both propositions. That research is vendor-sponsored and dates from 2022, which is worth knowing before anyone leans on it. It is also the most-cited finding in the field and nothing published since has changed the shape of it: Pynt's 2025 benchmark found a quarter of developers overwhelmed by the volume of vulnerabilities reaching them and a third naming false positives as a leading obstacle.
The mechanism is not mysterious. Shift-left was widely implemented as a scheduling change, running the same scanners earlier, when the actual problem was precision. Tooling that reports findings in the tens of thousands without the context to rank them does not make software safer by reporting them sooner. It relocates a backlog into the workflow of the people least equipped to triage it, and then it gets switched off, or ignored, which amounts to the same thing.
So most of this work is about what you do not run. Fewer checks, placed where a developer can act on them, with the ranking done before the alert rather than after. That is a slower thing to build than a pipeline full of scanners and it is the only version of it that survives contact with a delivery team.
Who leads this work
The remit, what it is accountable for, and the line between a Fractional CISO and a Fractional CIO.
See the leadershipWhere it meets the estate
Security posture is a property of the estate underneath it. Legacy you cannot safely change is legacy you cannot safely patch.
See Technology & DataWhere it meets your suppliers
Third-party risk becomes a commercial problem at renewal. That is the same conversation as concentration and exit terms.
See ProcurementStart with what you could prove today
A questionnaire you cannot answer, an insurance renewal getting harder, a diligence process about to open, or a pipeline full of alerts nobody reads. A direct conversation about where the exposure is.