You can commission cybersecurity consultancy as a limited project that concludes with a report you own, or as a standing retainer in which the consultant remains within your decision cycle. Both are sold with identical language, comparable day rates and the same acronyms on the slide. The bounded form splits again into work that tests your controls and work that tests your people. The fork that decides value is bounded against standing, and it turns on one question: who has the decision after the project concludes.
That question belongs in procurement. The ways it can break are opposites. A limited evaluation acquired when you needed a permanent capacity gives you a well-formatted account of a problem you still cannot fix. A monthly payment for a service you acquired for one defensible judgement means you pay for reassurance.
Which three types of cybersecurity advisory are available?
Cybersecurity consultancy comes in three recognisable forms. Almost every proposal is a blend of them, weighted towards whichever one the supplier sells most of.
The standards-led assurance engagement sells evidence. You buy an independent review of how your controls align with a specific framework, usually ISO/IEC 27001, Cyber Essentials, the Minimum Cyber Security Standard or the NIST Cybersecurity Framework. GRC Solutions catalogues that landscape in detail, noting that ISO 27001 carries 93 best-practice controls applied according to the risks you face, and separating certifiable standards from the top-level 10 Steps material. The deliverable is a gap analysis, a maturity score and a roadmap.
The threat-led readiness engagement sells a rehearsal. You get adversary-informed pressure on your detection and response through tabletop exercises, red and blue team work or an incident readiness assessment. CrowdStrike defines advisory work of this kind as exercises, assessments and recommendations, explicitly addressing strategic questions such as policy formation and framework development.
The embedded consultancy agreement sells availability. A specific practitioner, usually titled virtual CISO, manages your security strategy, budget, risk register and regulatory correspondence. Forvis Mazars runs that as a standing role which aligns security with business objectives and takes on the Information Security Officer function from inside the client.
The meaning of the word advisory before a vendor uses it
There is a definitional problem worth knowing about before you read any proposal. In threat intelligence, advisory has a settled meaning. The CISA advisory library separates alerts from advisories by depth and use, where an alert gives immediate awareness of a high-priority vulnerability and a rapid response while a cybersecurity advisory gives detailed threat actor tactics, techniques and procedures, indicators of compromise and recommended detection, mitigation and response actions. The same page lists 5,097 entries, which is the honest measure of how much of this material is there.
Commercial advisory services use the word far more loosely. Translate every proposal before you price it: the supplier may mean an assessment, a retainer, or a platform licence with some consulting hours attached. Ask which of the three forms above is being sold.
Where each shape earns its fee, and where it does not
| Attribute | Standards-led assurance | Threat-led readiness | Embedded adviser mandate |
|---|---|---|---|
| Primary artefact | Gap analysis, maturity score, certification roadmap | Exercise findings, detection gaps, response playbooks | Decisions taken inside your governance cycle |
| Evidence base | Control coverage against a named framework | Observed adversary behaviour against your environment | Your risk register and your budget |
| Binds whom | Auditors, customers, insurers | Incident responders and the SOC | The executive and the board |
| Clock starts | The scoping workshop | The scenario | The day the retainer begins |
| Fails when | The framework outranks your actual risk | Nobody owns the findings after the debrief | No one inside can tell whether the advice is good |
| Commercial shape | Fixed fee per assessment | Fixed fee per exercise programme | Monthly retainer with a notice period |
Read the third row again. Assurance binds people outside your organisation. Readiness binds people inside the technical function. Only the embedded mandate binds the executive. That is the row most buyers skip, and it decides whether anything changes after the report lands.
How do different candidates define a finding?
Ask each candidate what a finding is made of. Assurance advisers count controls. Forvis Mazars presents its maturity assessment as a balanced view across people, processes and the technology deployed, which is the fair position, but the result is still a control score. Readiness advisers count behaviours: The time taken for detection, whether containment worked, and what the analyst actually saw on the screen.
Dell positions its advisory work as assessment and planning, with a ransomware readiness assessment covering more than 50 security controls, and separates that cleanly from managed detection and response, which is the ongoing monitoring and investigation layer. That separation matters commercially because it tells you where consultancy finishes and operations begin.
The practical test is free. Ask for one anonymised finding from a comparable client and read it. A control finding reads like a checklist item. A behaviour finding reads like a story with a time stamp.
How the NCSC 10 Steps guide the board's responsibility
The NCSC's 10 Steps to Cyber Security provides guidance for medium and large organisations that employ someone dedicated to managing cyber security, and it places the subject firmly within the responsibility of the board. It breaks the problem into ten components and links out to deeper guidance where the detail matters. Treat it as the floor that any engagement should touch. It is not a target state, and a consultant who regards it as one is selling compliance theatre.
A policy layer most security teams never see is above that floor. The National Cyber Advisory Board is a forum bringing academia, industry and the third sector into a national dialogue, and its recent work has run on post-quantum cryptography, the enterprise security impact of AI and cross-sector threat intelligence sharing. This is not procurement guidance, but it tells you which questions a credible consultant should have a view on when you ask.
How the payment model predicts the way it breaks
Bounded engagements fail at the handover. Consultants receive payment to locate and explain. No part of that agreement pays them to see the fix land. Include the handover in the scope: Assign internal owners for each finding, a re-test time, and a clause returning part of the fee if the plan is not adopted. Advisers who resist that clause are telling you their model.
Retainers fail at renewal. The supplier receives payment to stay, and no part of that agreement requires them to make themselves unnecessary. Use a capability measure for the review. A dependency is created when an internal team is unable to take over two of the functions the retainer covers by the second renewal.
Security advisory that operates only inside the security function must be reconciled with the rest of the estate. Security spending competes for the same budget line as platform work, data work and integration work, and the case is strongest when it is argued in the same language. The technology advisory consulting perspective on what a business actually needs is the correct beginning for that reconciliation, because it asks what the technology is for before it asks what the security costs.
Independence, and what to check in the proposal
Two checks decide most of this. First, does the consultant resell what they will recommend? Price the bias of a supplier publishing an assessment that leads to its own platform. Second, does the consultant possess the standard they will audit you against? A firm that is part of certification bodies, has lead auditor credentials or creates the frameworks used to assess you has a different relationship to your evidence than a generalist does.
Set the threshold in the proposal, before agreement negotiation gives you less room.
| Test | Clears | Fails |
|---|---|---|
| Deliverable ownership | Named internal owner per finding, with dates | Findings addressed to the security team as a group |
| Evidence type | At least one behaviour-based finding from a comparable environment | Control coverage only |
| Handover | Re-test scheduled and priced in the original scope | Roadmap delivered as the final artefact |
| Commercial independence | Recommendation set not tied to resale | Platform licence bundled into the advisory line |
| Executive exposure | Findings presented to the board by the adviser | Findings delivered to the CISO alone |
That table is the decision. If a proposal cannot clear four of those five rows before you negotiate anything, the shape is wrong for the problem you have.