Risk visible at the wrong level: Where the cyber picture lives inside the technology function, governance weakens by default. The board cannot challenge what it cannot see, and a CISO ends up carrying a risk appetite decision that was never theirs to make.

Risk appetite that does not bite: Most firms have a cyber risk appetite statement. Fewer have one that has ever changed anything. If no project has been paused, rescoped or escalated because of it, it is a sentence rather than a control.

Change portfolios that outrun the risk framework: A firm running four significant programmes at once is changing its exposure four times, on four timetables, usually without a consolidated view of what the estate will look like when they all land.

Strategy that ages quietly: Threat actors, techniques, suppliers and your own architecture all move. A strategy written two years ago and not maintained now describes a firm that no longer exists, and nobody notices until an incident makes it obvious.

Obligations arriving together: SS1/21, SS2/21, the Critical Third Parties regime, Consumer Duty, and where you hold EU entities or exposure, DORA. Each has a cyber dimension. Managed separately they produce duplicated effort and inconsistent answers to the same question.

Ownership spread thin: Cloud, outsourced platforms and deep supplier dependencies mean cyber risk is now part owned by technology, operations, procurement and risk. Where that is not deliberately coordinated, the gaps sit between the owners.

We build the risk picture from evidence: Assessment, testing and modelling that establish real exposure, so the strategy rests on findings rather than assumption.

We wire cyber into the change process: Risk input at business case and design stage, not at go live. A short, workable gate that tells a programme board what the security cost is while the budget is still being set.

We make cyber risk governable: Appetite, tolerance, indicators and reporting designed so the board sees the right things at the right level and can hold a named person to account. Governance that produces challenge rather than attendance.

We connect the obligations once: One control environment mapped across the regimes that apply to you, so a single piece of work serves SS1/21, SS2/21, CQUEST and the internal audit plan instead of three exercises answering them badly.

We size investment against risk: What to fix, what to accept, what to transfer, with the reasoning documented well enough to defend in two years to someone who was not there.

We plan for the day it fails: Incident response arrangements that reflect how your firm actually behaves under pressure, tested through simulation rather than assumed to work.

We sit between the technical and the strategic, which is where cyber risk problems actually live: Our team can read a penetration test finding and write the board paper that explains why it matters to the mortgage book.

Built for mutual and specialist business models: Concentrated supplier estates, shared platforms, long lived legacy, and consolidation that inherits somebody else's decisions. We build strategies for those conditions rather than adapting one built elsewhere.

Proportionate to the firm, not the framework: Strategies built around frameworks produce documentation. Strategies built around the firm produce risk reduction.

Forward facing: The risk picture is refreshed as the plan progresses, so you are governing the firm you are becoming.