Business risk
Could a cyber incident materially disrupt operations, cause financial loss or expose critical information?
Independent cyber advisory & vCISO
Protect what mattersBuild cyber resilienceReduce business risk
An independent, business-risk-led assessment of your cyber posture — identifying the risks that matter most, how effectively they are controlled today, and what management should prioritise next.
The foundation of an ongoing vCISO relationship. Includes AI usage / data exposure and OT / industrial environments where relevant.
Independent assurance. Senior judgement. Focused on what matters to your business.
Why independent assurance
Cybersecurity is rarely a blank-sheet problem
Most organisations already spend — but several pressures make assurance increasingly important.
Customer & supply chain
Can you demonstrate appropriate security to major customers, partners and the organisations whose supply chain you support?
Regulation & compliance
Can you show that cyber controls and governance meet regulatory, contractual and insurance requirements?
Investment effectiveness
Are your existing security investments, MSPs, suppliers and controls focused on the risks that matter most?
The assurance gap
Activity is not the same as assurance
You may already have
- An MSP / IT provider
- Microsoft security & endpoint controls
- Backups, firewalls and cyber insurance
- Policies, training and compliance activity
But can management answer
- What are our material cyber risks?
- Which controls and suppliers address them?
- Where are the important gaps?
- Are we spending on the right things?
- What should we do first?
What Crannog does
Start with the business outcome, then use evidence, controls and frameworks to support the answer
Understand
Critical services, data, dependencies and external obligations.
Assure
Assess whether existing controls, suppliers and investments address those risks.
Prioritise
Separate material business risk from lower-value technical noise.
Advise
Give management clear decisions, actions and investment priorities.
Govern
Maintain oversight as the business, threats and obligations change.
Frameworks and tooling are inputs. The product is clearer business risk, better decisions and proportionate action.
The usual starting point
Cyber Risk Baseline
- 01Business & exposure contextWhat could materially hurt the business?
- 02Current protections & control effectivenessAre current controls, providers and practices reducing the risks that matter?
- 03Governance & preparednessWho owns the risk, and are we ready?
- 04Material risk prioritisationWhere are the gaps that actually matter?
- 05Management action planWhat should we do first — and over the next 12 months?
The cyber leadership gap
Your MSP manages technology. Management owns cyber risk.
Every material business risk needs accountable leadership—not delegation to a technology supplier.
Board / CEO
Owns and accepts business risk
Finance leadership
Financial risk and investment
Operations leadership
Operational delivery and resilience
People leadership
People, culture and workforce risk
Independent cyber leadership
Cyber risk • Investment • Assurance
MSP / Internal IT
Implement • Operate • Monitor • Remediate
The organisation operating the controls should not be the only party deciding whether those controls are sufficient, effective and worth the investment.
Management owns the risk. Crannog provides independent leadership and assurance. Your MSP operates the controls.
Most SMEs have senior leadership for finance, operations and people, but no equivalent leadership for cybersecurity. Responsibility often passes directly from management to the MSP or IT provider.
The MSP may operate excellent technology, but decisions about business risk, acceptable disruption, investment priorities and control effectiveness must remain with management.
Crannog fills this leadership gap—working alongside existing providers to govern cyber risk, prioritise investment and independently assure outcomes.
Partnership levels
Three levels of vCISO partnership
Choose the level of assurance and leadership the business needs.
Essential
Independent Assurance
Know whether the risks that matter are being addressed.
- Baseline & roadmap
- Annual risk refresh
- Key-control assurance
- Management risk briefing
Managed
Ongoing Cyber Governance
Keep material cyber risk visible, prioritised and under control.
- Quarterly risk governance
- Supplier / control assurance
- Remediation priorities
- Incident tabletop & reporting
Strategic
Virtual CISO
Bring senior cyber judgement into important business decisions.
- Regular executive engagement
- Strategy & investment planning
- Board-level risk reporting
- Incident / crisis leadership
Standalone advisory
Focused engagements where a specific business driver or risk needs deeper attention
Cyber Risk Baseline & 90-Day Plan
Independent view of material risk and priorities.
AI Security & Governance Review
Adopt AI while managing data and governance risk.
NIS2 & CyFun Readiness / Assurance
Address regulatory and supply-chain expectations.
Security Tool & Control Assurance
Test whether controls deliver the intended outcome.
Board & Executive Cyber Training
Improve executive understanding and accountability.
M365 / Identity Security Review
Reduce identity-led business risk.
OT / Industrial Cyber Risk Review
Reduce cyber risk to critical operations.
Incident Response Tabletop
Prepare management to decide under pressure.
Security Investment / Vendor Review
Make better security spend and supplier decisions.
Employee Cyber Resilience Training
Strengthen the human layer where it matters.
Principal-led by design
Senior cyber leadership. Directly accessible.
Thomas Parsons
Founder & Principal
25+ years across cybersecurity, technology and leadership. Internationally, including the United States.
Senior cybersecurity and product executive with experience spanning security research, engineering, product strategy, international growth and executive leadership.
Executive & board
Former VP Product Management at Tenable (NASDAQ: TENB); Ireland Site Leader and Board Member of Tenable Ireland. Built and led global teams of up to 100 people.
Global cyber experience
Senior roles across Intel, Symantec and Tenable — identity security, exposure and vulnerability management, EDR, SIEM, security research and AI-enabled security.
Policy & industry influence
OECD and EU policy engagement, including work contributing to OECD Digital Economy Paper No. 307 on vulnerability treatment. Featured in IDA Ireland's Leadership Series.
Research & recognition
Cybersecurity patent holder; contributor to Symantec's Internet Security Threat Report. Quoted by the Wall Street Journal, BBC, CIO Magazine, CNET and ZDNet.
The question is not “how many security activities are we doing?” — it is “are they addressing the business risks that matter?”
Why Crannog?
A crannog was a protected island settlement, used for centuries as a place of security and resilience.
Crannog Cyber takes inspiration from that idea — practical protection, built around what matters most.
PROTECT WHAT MATTERS. BUILD RESILIENCE AROUND IT.
A useful first conversation
What could hurt the business? · What are you already doing? · How do you know it is enough?
advisory@crannogcyber.com