CISO-as-a-Service for growing businesses
Cyber Security under control in 30 days.
Senior cybersecurity leadership and accountability without the cost of a full-time CISO.
Your foundation delivered in 30 days, or you don’t pay. £0 upfront. First payment on Day 31.
- Matthew Carr, CISSP
- Freeman, Worshipful Company of Information Technologists
- 15 years across adversary simulation, critical infrastructure and executive cyber risk
- Experience built across Home Office (HM Government) and FRA Sweden
Experience built across
- Home OfficeHM Government
- FRASweden
Work directly with senior cybersecurity leadership. No layers of junior consultants.
You probably don’t have a tool problem. You have an ownership problem.
- Penetration test
- Report
- Problems flagged
- Then what?
- Who decides what actually matters?
- What gets fixed first?
- Who checks the same issues are not still open next year?
Not another tool. Not another report. Someone who owns the cybersecurity outcome.
Find. Fix. Verify. Prove.
Find
We assess where you really stand and what actually matters.
Fix
Your MSP, vendors and internal team do the work. We direct it, set priorities and chase it to completion.
Verify
We retest each fix.
Prove
We sign it off and record the evidence.
Every issue gets an owner, a deadline and a retest. Closed means proven closed.
Evidence built to the standards your insurer, your auditor and your enterprise customers ask for.
The first 30 days
- Week 1
Understand
Get to know the business, its systems and the existing security setup.
- Week 2
Assess
Measure the current security position and find where the gaps are.
- Week 3
Prioritise
Work out what actually matters and what needs attention first.
- Week 4
Plan
Build the roadmap for remediation and improvement.
At the end of Week 4 you have three things in your hands: a risk register with an owner for every risk, a prioritised security roadmap, and a remediation plan saying who fixes what, and by when. That’s what ‘foundation delivered’ means.
You see the result before you pay.
Months two and three: Fix and Verify
- Month 2
Fix
The remediation plan goes live. Your MSP, vendors and team work through the priorities, and we track every item to its owner and deadline. You get your first monthly executive decision session.
- Month 3
Verify
We retest what’s been fixed and close each item with evidence. Your incident plan gets tested, and your first quarterly board report shows what’s closed, what’s open and what’s next.
From then on: a rolling roadmap, monthly decisions, quarterly board reporting, and support with audits, customers and deals.
Ready for the frameworks and rules your buyers ask about
- Cyber Essentials
- ISO 27001
- SOC 2
- HITRUST
We prepare you for Cyber Essentials, ISO 27001, SOC 2 and HITRUST, and stay with you through the assessment. Cornhill is not a certification body. We prepare you for certification by accredited bodies.
Getting ready for the UK Cyber Security and Resilience Bill, now going through Parliament.
One partnership. One fee.
£7,000
per month
£0 upfront. First payment on Day 31.
Everything required to establish and maintain the cybersecurity leadership function
- A security leader
- A rolling security roadmap
- A risk register somebody owns
- A monthly executive decision session
- A quarterly board report
- An incident plan you’ve actually tested
- Security support for customers, audits and commercial deals
- Oversight across MSPs, vendors and critical platforms
Built as an ongoing cybersecurity leadership partnership. No long-term lock-in: leave at the end of any month with 30 days’ notice.
As an investor, I need to understand cyber risk across our portfolio quickly and clearly. Strong due diligence on new investments and ongoing monitoring across the portfolio. The reporting is actionable, and the team understands the pace and priorities of growth-stage investing. Matthew is a rare talent.
Tell us what keeps being postponed.
A first conversation takes about thirty minutes and costs nothing.