// SECURITY CONSULTING AND ASSESSMENTS · HANS STUDY · ONTARIO, CANADA
Security Consulting and Assessments
Not every problem needs a CISO on retainer. Sometimes you need a specific piece of work done well by someone independent: a clear-eyed assessment, an architecture you can trust, a network hardened properly, or an experienced set of eyes on a project that's about to go sideways. That's the consulting side.
Everything here is vendor-agnostic. I don't resell hardware or software, I don't take finder's fees, and I don't run your operations. When I recommend a control or a product, it's because it fits your risk, not because it's on a price list I benefit from.
Assessments
A security program and gap assessment tells you where you actually stand against the standard that matters: NIST 800-171, NERC CIP, ISO 27001, or CIS Controls. You get a gap analysis, a maturity rating, a third-party and vendor risk read, and a remediation roadmap your board, auditor, or insurer can act on. A convergence assessment goes after the gaps a conventional audit misses because it never looks at the cameras, the controllers, or the OT boundary.
Architecture and hardening
Independent security architecture for the network and systems underneath your operation, and hands-on hardening of the platforms I work in daily: Windows server and workstation, Cisco, Aruba, and the rest. This is the tuning-and-hardening work that closes the gap between a system that passed acceptance testing and one that actually holds up.
Project and program oversight
Independent oversight for a specific build: a Genetec deployment, a network modernization, a site or campus security upgrade. I sit on your side of the table, hold the integrator and the design to a standard, and catch the problems before they're poured into concrete or pulled through conduit. I've spent enough years watching poorly deployed systems pass sign-off to know exactly where to look.
Related advisory areas
Security Leadership, Advisory, and Strategy →
The hub for fractional CISO, strategy, compliance, and convergence work.
OT/IT and Physical Security Convergence →
The boundary assessments a conventional security audit never reaches.
Security and Technology Strategy →
When the engagement points toward direction rather than a single piece of work.
Scoped per engagement
Consulting work is scoped per engagement. Email contact@hans.study with what you're dealing with and I'll tell you whether it's something I can help with.
Start a conversation