Large product organisations rarely need another full-time security manager. They need someone senior who knows their portfolio, is reachable when a decision cannot wait, and keeps the compliance programme moving between projects.
The retained advisor engagement gives you that person: a named cetome expert, a fixed number of days per month, and direct access for your product, engineering and legal leadership.
What you get
With a retained advisor, your leadership team gains a partner for the decisions that shape the portfolio. Your product security becomes:
Decided in time
Governed at portfolio level
Implemented with your teams
Independent
Our services
The retainer combines the following, in proportions reviewed every quarter.
Portfolio oversight
A standing view of every product line against the CRA, RED and the standards that apply: what is compliant, what is at risk, and what must be decided this quarter.
You receive a one-page status for your steering committee, with the decisions it needs to take and their consequences.
Decision support
Architecture choices, conformity assessment routes, vulnerability handling, supplier questions: a written recommendation within days, with options, risks and cost.
Each position is documented, so that your board, your auditors and your notified body see the same reasoning.
Governance and implementation
We help you set up the organisation, the policies and the processes the CRA expects, then stay with the teams who run them.
Design reviews, supplier requirements, vulnerability handling and the technical file: implementation that moves between projects, not only during them.
Proposals and business cases
Budget requests, make-or-buy decisions, laboratory and tooling selections: the case prepared in the language of risk and revenue, ready for your executive committee.
You get a proposal that survives the finance review, with the assumptions and the alternatives laid out.
Executive briefings
Board and leadership sessions on market access, exposure and priorities, in the language of risk and revenue rather than technical controls.
Ninety minutes that leave your executive committee with a shared picture and a decision.
Regulatory watch
Harmonised standards, delegated acts and guidance change. You receive what changed and what it means for your products, in one page, when it matters.
Your roadmap is adjusted before the change becomes a finding.
How we work
Working with your leadership, month after month
A retainer is a working relationship, not a subscription. We sit with your product, engineering and legal leadership, prepare the decisions and stay accountable for the outcome.
-
Portfolio assessment
Both sides start from the same picture: every product line against the CRA, RED and the applicable standards, and the decisions that cannot wait. -
Monthly working sessions
A fixed allocation of advisor days, spent with your teams: steering committees, design reviews, supplier questions and the compliance programme between projects. -
Decisions, documented
For each question you receive a written recommendation with options, risks and cost, ready for your board, your auditors or your notified body. -
Quarterly review
Progress against the roadmap, what changed in regulation and standards, and the allocation for the next quarter.
Starting a retainer
A retainer starts with a portfolio assessment, so that both sides know where the products stand. The engagement then runs on a monthly allocation of advisor days, reviewed every quarter, with a fixed-scope statement of work for any larger piece of delivery.
A retainer is priced by the effort it takes each month, not by the calendar. The four bands below differ in how far we go: from being part of the organisation, to carrying the function for you, to doing the work with your teams, to telling you what a requirement means. What each one covers is an example rather than a fixed list.
Exclusive
30,000 €
a month and above
We are part of the organisation. Everything in the band below, with a dedicated team of experts who work on your portfolio and no one else’s, and your requests come first: we hold capacity for you, so a question that arrives on Monday is not waiting on another client’s week. The retainer covers more than one legal entity or brand, which is where a group with several of them would otherwise pay several times over, and your executive committee gets a standing quarterly readout on where the portfolio stands.
For a group running an enterprise-wide programme to a regulatory deadline, where the cost of a decision waiting is larger than the retainer.
Extensive
15,000 € to 30,000 €
a month
We carry it. Management of your product security governance, operational support on vulnerability management, and a virtual product security officer at your side. At this level you have a team of experts running parallel work packages, not a single advisor, drawn from the people whose experience fits the work in front of you.
For taking weight off a team that has too much of it, or for contributing to an enterprise-wide compliance programme.
Collaborative
5,000 € to 15,000 €
a month
We contribute. Analysis of how the requirements are actually being implemented, a pilot run with your engineering teams, and support for the governance around it.
For starting quickly, or for spreading the effort across a few quarters.
Supportive
2,000 € to 5,000 €
a month
We advise. Document review, a read on how a requirement should be interpreted, and support while you decide your course of action.
For starting small over a few months, while the programme finds its shape.
Prices exclude VAT. Travel for on-site work is extra.
The monthly figures above assume a quarterly commitment. A longer one is discounted. You choose how much of the work you want us to carry, and you can move between bands as the programme changes. Tell us what you have in mind and we come back with a proposal.