Clear security decisions, without a full-time security team.
I help organizations understand their security risk, write the policies that govern it, design how identity and access are managed, and meet the expectations of insurers, auditors and partners.
Available for project-based engagements and B2B contracts.
What I do
Practical security work for organizations that have outgrown traditional IT, but don’t need a full-time security executive.
Security assessments
An honest, plain-language picture of where you stand, measured against the NIST Cybersecurity Framework, with priorities you can act on.
Policy writing
Security policies written for how your organization actually works, in language your staff will read, follow and sign.
IAM workflow design
Joiner, mover and leaver workflows that give the right people the right access, and take it away the day they leave.
Compliance and insurance
Ready answers for cyber insurance questionnaires, customer security reviews and audits, backed by controls that are really in place.
AI governance
AI use policies, AI tool and vendor reviews, and AI risk assessments aligned with the NIST AI Risk Management Framework, so AI is used safely and you can show it.
Incident readiness
A written response plan and a rehearsed team, so a bad day stays a bad day instead of becoming a crisis.
Also available as a monthly plan: remote management of your identity, devices and cloud apps, with security built in. See how engagements work
Good security isn’t a product you buy. It’s a set of decisions someone has to own.
I’ve spent more than twenty years working in IT, networking and security across distributed, multi-site environments. The pattern is always the same: the technology is rarely the problem. What’s missing is someone who decides how things should work, writes it down, and checks that it happens.
That’s the role I take on. You work with me directly, from the first call to the final report.
Chris Leach
More about meFree self-checks
Practical tools I’ve built and made free to use, with no sign-up. The two checklists run entirely in your browser.
AI security check
Sixteen questions on AI tools, shadow AI, data and integrations. A score out of 100 and the five steps that matter most.
Take the check EnglishSecurity check
Fifteen questions on governance, technical controls and people. A score by area and the five steps that matter most.
Open the checklist EnglishDomain security scan
A passive check of a domain’s email authentication (SPF, DKIM, DMARC), HTTPS, DNSSEC and CAA records, with plain-language next steps.
Scan a domain