A one-off assessment finds today's problems. Most Kenyan SMEs, startups, and NGOs don't have — and don't need — a full-time security hire, but they do need someone who understands their systems well enough to keep asking the right questions as the business changes.
This is fractional cybersecurity consulting: a standing advisory relationship, not a single deliverable. It sits above the specific technical engagements — the assessments, audits, and reviews — as the ongoing function that decides what to prioritise and when.
Who this is for
- Businesses that have outgrown ad-hoc security decisions but aren't ready to hire a full-time CISO.
- Teams that need a named, accountable security contact for enterprise clients, banks, or donor due diligence.
- Founders who want security built into product and vendor decisions before they ship, not audited after.
What the advisory covers
| Area | What It Involves |
|---|---|
| Roadmap & Budget | A prioritised, right-sized security roadmap matched to actual risk and available budget — not a generic checklist. |
| Policy & Process | Practical policy documents (access control, incident response, acceptable use) that a small team will actually follow. |
| Vendor & Third-Party Risk | Reviewing new vendors, SaaS tools, and AI providers before they get access to customer data. |
| Incident Readiness | A tested plan for who does what in the first hours of a suspected breach, before it's needed. |
| Board & Client Reporting | Plain-language security posture updates for boards, investors, or enterprise clients requiring attestation. |
How it connects to the rest of the practice
The advisory relationship is where specific engagements get commissioned and sequenced: a Web & API Security Assessment when a new product ships, a Security Audit ahead of a funding round or enterprise deal, a Data Protection Site Audit when the data footprint grows, or an AI Security review before an AI feature launches.
Evidence and method
Client-facing advisory delivery — sequencing findings into a security baseline and handing it over to an internal team — is documented in the Munar security baseline and handover.
Frequently asked questions
How is fractional consulting different from a one-off assessment?
An assessment finds today's problems. Fractional consulting is a standing relationship that keeps asking the right questions as the business, product, and vendor list change — deciding what to prioritise and when, on an ongoing basis.
How much time commitment does this require from us?
Scope is set per engagement — typically a recurring cadence (monthly or quarterly touchpoints) plus ad-hoc input on vendor and product decisions, sized to the business rather than a fixed retainer template.
Do you replace the need for a full-time CISO?
Not for every business — this fits teams that have outgrown ad-hoc security decisions but aren't yet at the scale or risk profile that justifies a full-time hire. It's a bridge, not a permanent substitute at larger scale.
Can you provide the named security contact our enterprise client or bank is asking for?
Yes — a named, accountable point of contact for due-diligence questionnaires, board reporting, and enterprise/donor security attestations is a core part of this advisory relationship.
How engagements start: the 48-Hour Secure Digital Workflow Assessment
Most clients begin with the 48-Hour Secure Digital Workflow Assessment, delivered jointly with HarLyn Digital Partners, which doubles as the diagnostic that shapes what an ongoing advisory relationship should prioritise first.
Engagements begin with a fixed-scope scoping call. Clear decisions before code, and no obligation to proceed to follow-on build work.
Request a Scoping Call →Related: Security Audits · Data Protection Site Audit · All services