Talk to us. Thirty minutes, an honest answer.
A real conversation with a senior Cliffside consultant. No sales pitch, no pressure. We'll help you understand what your real risks are and whether you need us at all.
If there's a genuine fit, we'll map next steps together. If there isn't, we'll tell you honestly — often pointing you to the right path without engaging us.
since 2008
based in Sydney
transferable advice, honest recommendations
The call
Thirty minutes, and you should leave with an answer.
Most first calls are a discovery script that ends in a proposal. This one ends with a position, including when that position is that you do not need us yet.
Where you actually are. We ask what triggered the call, what you already have in place, and what is already committed. It is not a maturity questionnaire and there is no score at the end.
What matters first. If there are five things on your list, we will tell you which one reduces risk most, and which two can wait a year without anyone getting hurt.
What it would cost. Rough numbers on the call, not after a two week scoping exercise. Where a fixed price fits, we name it. Where it does not, we say why.
Whether we are the right people. Our practitioners hold ISO 27001 Lead Auditor, CISSP, SABSA, OSCP and CREST credentials. Where your problem sits outside that, we will point you at someone who does it better.
Before the call
There is nothing to prepare.
You do not need documents, a maturity score, or an approved budget. If a board paper, an auditor's finding or a client security questionnaire is what started this, bring it and we will read it beforehand. If you have none of that, the call still works.
Who you will be speaking to. A senior consultant. Not a salesperson, and not a junior taking notes so someone senior can call you back later.
What we do with what you tell us. We use it to prepare for the call. You are not added to a nurture sequence, and your details are not passed to anyone.
How long until you hear back. One business day to confirm a time.
Honest answers
The call is free because sometimes the answer costs us the work.
Assessment first is not a tagline here, it is how the commercial model works. We would rather lose an engagement on the first call than deliver one that was never going to help.
Real reasons we have told organisations not to engage us. The control they wanted penetration tested had not been deployed yet, so testing it would have proved nothing. The framework they had been asked to certify against was the wrong one for their actual obligations. The problem was a staffing gap that no programme of work was going to close. In each case we said so on the call, and in most of them they came back later for the thing they actually needed.
If that is the kind of conversation you want, the form is at the top of this page.