Your technology performs.
Your resilience proves it.
For supervised financial entities. We change the capability, we run it, and we prove it stays under control — under a contract your supervisor can read.
Three capabilities, one provider
Buy one, or buy the sequence. The accountability is identical in all three.
The pressure is no longer only regulatory
Organisations are being reshaped by four forces at once. Meanwhile the regulatory clock does not stop.
AI & automation
Lower cost of code and analysis
Threat Delivery becomes commoditised
Opportunity AI-native operating models
European market
Low growth, higher uncertainty
Threat Discretionary projects delayed
Opportunity Cost, productivity, efficiency
Capital flows
Capital moves to growth and infrastructure
Threat Portfolios and concentrations shift
Opportunity New risk, controls and data
Geopolitics
Fragmentation, energy and trade shocks
Threat Volatility and third-party exposure
Opportunity Scenario, resilience, TPRM
Regulation
An obligation that never closes
Threat Registers, reassessment, evidence on demand
Opportunity DORA, AMLD6, AI Act, NIS2
The market answers half the question. Advisers design but do not run. Consultant networks supply people but do not answer for the outcome.
Change it. Run it. Prove it.
One provider across the three capabilities — and a contract your supervisor can read.
What you buy, and in which mode
Four capabilities down the side, three modes across the top. Buy one cell, or follow the sequence — the accountability is identical in all three.
| Change itWe design & transformA capability that works | Run itWe execute & automateAn operation that holds | Prove itWe monitor & challengeEvidence you can show | |
|---|---|---|---|
| 01Technology & digital | Digital strategy, target architecture and operating model, cost optimisation | Business analysis, automation, officer-as-a-service | Architecture assurance, data analytics, IT control testing |
| 02Resilience & security | Resilience framework, ICT and third-party model, data governance | Continuous assessment, incident response, third-party due diligence | Register of Information, incident table-top, resilience testing |
| 03Risk & assurance | Risk framework, control and metrics library, RCSA design | Cloud oversight, control monitoring, scenario definition, risk assessment | Independent review, thematic testing |
| 04Regulatory compliance | Gap analysis, regulatory change and remediation programme | Regulatory watch, regulatory reporting, compliance assessment | Inspection readiness, supervisory response |
← Prove it produces the findings that scope the next Change it — the cycle repeats.
Present in every cell. Transformation & change — organisation design, change management, remediation, education, executive interim. Most clients enter on Change it or Prove it.
Measured against
DORACSSF 22/806CSSF 25/882EBA GL 2019/02EU AI ActNIS2TIBER-LU
A non-exhaustive list, Luxembourg and EU first. A text is not a service: each of these lands in one capability and is bought in one mode. See where each one lands →
We operate our own stack
We do not resell these tools. We run them ourselves, in production, before we ever operate them for a client.
We know the code
Open source, mastered in depth
We hold the logic, the data model and the rules. No vendor sits between a question you ask and the answer we give you.
We operate it
Self-hosted, run by our team
No public cloud, no managed provider in the chain. The people who run the service are the people who built it.
We own the roadmap
No licence that holds us hostage
European or self-hosted components we can fork, extend and exit. What you need next does not wait for a vendor’s release cycle.
Workflow & robotics
n8n
Artificial intelligence
Ollama · OpenWebUI
Analytics & data
Metabase · Airbyte
Business management
Odoo
Regulatory watch
R-Watch
Supplier compliance
ProCurate
Two are ours. R-Watch and ProCurate are built by Axon. The others are open-source platforms we run in production every day.
Built to be registered
Run it and Prove it are outsourced services. Your supervisor expects to see who provides them, under contract, with audit rights and an exit plan.
Register-compatible
A provider your Register of Information can name. Contract, audit rights, exit plan and continuity — aligned with CSSF 22/806, EBA GL 2019/02 and DORA.
One provider across the cycle
No handover loss between the firm that designs, the one that runs and the one that checks. The same team carries the context.
A team, not an availability
Documented method, shared institutional memory, no single-person dependency.
Accountable for the outcome
We sign the deliverable and own it — in front of your Board and, if needed, in front of the regulator.
Flexible when you need it. Fractional CTO, CISO or Outsourcing/Cloud Officer — one to two days a week, six or twelve-month contract, with the same accountability.
Who we work for, and what they ask us next
The profile of our client base, and what happens once the first engagement is done.
0%
of our work is in banking and insurance
Not a generalist practice that also does finance.
1 in 2
of our clients is a large enterprise
EU definition: 250 staff or more, or above the SME financial thresholds.
2 in 3
clients re-engage us on more complex work
A diagnostic becomes a remediation; a remediation becomes an operated service.
Read us before you hire us
Regulation, technology, operating models — written by the people who do the work.
Adoption Tripled. Governance Went Backwards.
Two numbers from this year, moving in opposite directions. Regular use of AI on corporate devices went from 15% of employees to 45% in twelve months, according to…
The EBA Did Not Ask for More Documentation. It Asked Whether Yours Holds.
Four Things Keep Going Wrong. They Are One Thing, Arriving in Four Stages.
Four things keep going wrong. They look like four separate problems, which is why they get separate owners — strategy to the executive committee, governance to risk, tool…
Test us before you commit
No procurement, no framework agreement, no commitment to the rest. A scoped diagnostic on a real question, and you judge on the output.
A written read of where you stand
A prioritised list of what to fix first
A demonstration on your own data — not a proposal