Cyber risk is
business risk.
We help companies understand their current risk, design a stronger future-state security program, and provide ongoing executive guidance to implement it effectively. Four connected services, one continuous program.
Assessment. Strategy. Advisory. Management.
Each stage produces an artefact the next stage consumes. Nothing gets re-litigated, and nothing lives in a slide deck that never gets opened again.
Full security assessment
Complete security risk visibility, delivered through deepcurrent GRC™ and aligned to the Black Bay COMPASS™ business risk model.
- You getSecurity maturity score and efficiency score, per domain
- You getIdentified gaps, prioritized against business risk
- You getAudit-ready reporting you keep regardless of what happens next
- Cost
$19,000$0 with a 12-month agreement
Three-year roadmap & blueprint
Built with deepcurrent GRC™ and the Black Bay deepwater Framework: seven clear domains for how to execute AI security correctly. Then run through a weekly co-management cadence with your team.
- Methoddeepwater Framework applied to the scored assessment output
- HorizonThree years, sequenced by business-risk reduction per dollar
- CadenceWeekly co-management with your security leader
vCISO advisory
Expert security advisory from a dedicated virtual CISO with 30+ years of experience, on weekly, monthly and quarterly cadences, and independent of every vendor relationship.
- WhoA named advisor, 30+ years experience before assignment
- RhythmWeekly check-ins · monthly reviews · quarterly board reviews
- IndependenceWe resell nothing. No product commissions, ever.
Co-managed program execution
Full access to deepcurrent for program execution: task assignment, risk tracking, framework alignment and executive-level visibility.
- ExecutionOwned, dated remediation tasks across both organizations
- VisibilityExecutive and board reporting generated from live data
- FrameworksISO 27001 · NIST · PCI DSS · SOC 2 · HIPAA
What sits inside the retainer.
Advisory hours are drawn against the work you actually need that quarter. Tier determines the monthly allocation and which specialized services are in scope.
Security program design
Target-state architecture, control selection and sequencing.
Risk assessment
Annual or bi-annual scored assessment inside deepcurrent.
Board & executive reporting
Quarterly board packs and executive narrative.
Policy & standards
Drafting, review and alignment to your chosen frameworks.
Incident readiness
Cyber resilience planning, tabletop exercises, recovery design.
Third-party risk
Vendor assessment method and ongoing supplier review.
Control solution research
Vendor-neutral evaluation: we have no product to sell you.
Architecture support
Design review and implementation guidance on the Advanced tier.
Thirty services. One program.
Filter by the problem you are trying to solve. Every item is delivered by your named advisor and tracked in deepcurrent, so findings land in the same risk register as everything else.
- Cloud Security AssessmentAssessment & Advisory
- Agentic AI Identity AssessmentsAI & Emerging Tech
- Policy ReviewGovernance & Compliance
- Incident Response PlanningResilience & Response
- Vendor Risk ManagementThird Party & Program
- Zero Trust AssessmentAssessment & Advisory
- AI Roadmap & Tool EvaluationsAI & Emerging Tech
- Security GovernanceGovernance & Compliance
- Tabletop ExercisesResilience & Response
- M&A Risk AdvisoryThird Party & Program
- AI IAM Risk AssessmentAssessment & Advisory
- AI Control RecommendationsAI & Emerging Tech
- Data Classification StrategyGovernance & Compliance
- Cyber Resilience PlanningResilience & Response
- Security Resource EvaluationsThird Party & Program
- Mobile/IoT Security AssessmentAssessment & Advisory
- Application Dependency MappingAI & Emerging Tech
- SOC2 ReadinessGovernance & Compliance
- Cyber Insurance EvaluationResilience & Response
- SecOps Process ReviewThird Party & Program
- Organizational AssessmentAssessment & Advisory
- Secure Software Dev AdvisoryAI & Emerging Tech
- PCI/DSS AdvisoryGovernance & Compliance
- OT Security RoadmapResilience & Response
- Security Awareness TrainingThird Party & Program
- Security Maturity ScoringAssessment & Advisory
- SEC Risk DescriptionsGovernance & Compliance
- MITRE ATT&CK AdvisoryResilience & Response
- Network Architecture ReviewAssessment & Advisory
- Board Risk PresentationsGovernance & Compliance
Showing all 30 services.
Before you book.
What is the deepwater Framework?
The Black Bay framework for turning an assessment result into an executable three-year roadmap and blueprint, across seven clear domains for how to execute AI security correctly. It is applied during the strategy phase, inside deepcurrent GRC™, so the roadmap stays connected to the findings that justified it.
How quickly can we start?
The COMPASS Executive Alignment Workshop is typically the first scheduled session. Under a 12-month agreement there is no upfront onboarding fee, a $19,000 value at $0.
Can you work alongside our existing MSSP or security team?
Yes. The model is explicitly co-managed: your team and your Black Bay advisor operate in the same deepcurrent tenant with separate scopes. We are advisory and independent, so we do not compete with your operational providers.
What happens after the assessment?
You own the output either way. If you continue, the findings become a prioritized roadmap and a weekly execution cadence. If you do not, you keep the scored baseline and the gap list.
Your assessment costs nothing and takes weeks, not quarters.
You will leave with a scored maturity baseline, a prioritized gap list and a three-year roadmap. What you do with it is entirely up to you.
No cost. No obligation. No vendor pitch. We don't resell anything.