Most boards receive cyber reporting written by technical people for technical people. I translate it into the language of the boardroom.
I'm David Viney (ACA, CITP), with 25+ years of technology leadership at WPP, Heathrow, the BBC and the Aga Khan Development Network. I've run cyber programmes where the stakes were highest: a state-actor DDoS and attack at a global marketing group, a £22m cyber readiness programme at critical national infrastructure, and a federated security rollout across a 96,000-person international organisation.
I turn that experience into fiduciary language, commercial consequence and decisions a board can make. Then I help deliver the programmes that close the gaps.
What I do
1. Fractional CISO and ongoing risk advisory
For organisations that need a CISO but can't justify a full-time one. You get a named, accountable individual who owns the cyber risk agenda. I attend board and risk committee meetings, set and maintain the cyber strategy, and make sure your security posture suits your risk profile and regulatory environment. I cover endpoint protection, threat intelligence, SOC management, security awareness, and identity and access management, reported to the board on a regular cadence.
2. Independent cyber assurance and board reporting
A second opinion for boards that can't rely solely on management's view, especially where the people running security are also the ones reporting on it. I assess your real security posture, your gap to relevant frameworks and the materiality of your exposure. I look at regulatory exposure, supply chain risk, incident response capability and whether your security investment is adequate. I have extensive experience in regulated and classified environments.
3. Cyber programme delivery and incident response
I run cyber programmes from strategy to implementation, covering technology selection, vendor management and the cultural change that makes security awareness stick. When an incident happens, I've been in the room before. I led the response to state-actor DDoS attacks and to major operational incidents at critical national infrastructure.
Selected experience
WPP: led the response to a major DDoS and cyber attack from state actors. Hardened 300+ vulnerable endpoints and web services using Okta and Cloudflare, under live threat conditions.
Heathrow Airport: IT Sponsor for the £22m Cyber Readiness component of the £1.3bn AMC Programme. Turned around a stalled programme (Microsoft Defender, Sentinel, Purview, Azure Monitor Agent) and delivered a new Isolated Recovery Environment and a Digital Control Tower for National Air Traffic Control.
Aga Khan Development Network: delivered a cyber programme across health, education, banking and rural development operations, including CrowdStrike endpoint security, an outsourced SOC with Obrela, and KnowBe4 awareness training and email protection.
How we start
The Technology MOT: a fixed-price, fixed-scope review of your current cyber posture, with no ongoing commitment. It gives both of us a clear picture before you decide on a Fractional CISO, assurance or delivery support.
