Frequently Asked Questions

Frequently Asked Questions

Cyber security can seem complex, particularly when discussions become dominated by technical language. Our frequently asked questions explain how Black Arrow Cyber Consulting helps organisations understand, manage and govern cyber risk in a practical and proportionate way.

About Black Arrow Cyber Consulting

What does Black Arrow Cyber Consulting do?

Black Arrow provides independent cyber security strategy, governance, risk and compliance advice, underpinned by current threat intelligence. We help organisations understand their cyber risks, assess whether their controls are appropriate and identify practical priorities for improvement.

Our services include cyber security gap analysis, board and senior leadership workshops, fractional CISO support, cyber security strategy, penetration testing, incident response exercises, employee education and phishing simulations.

What makes Black Arrow different from other cyber security consultancies?

Black Arrow combines deep technical expertise with experience in intelligence, national security, law enforcement, regulation, finance, human resources and business transformation.

This allows us to consider cyber security as a business risk rather than purely an IT issue. Clients benefit from the collective knowledge of a multidisciplinary team, with controls considered across people, operations and technology.

Is Black Arrow an IT service provider?

Black Arrow is not an IT service provider, and we do not manage cyber security technology. This is why our clients work with us: we provide independent, impartial and objective advice. This allows us to assess the controls provided by internal teams and external suppliers without having a commercial interest in recommending particular technologies or additional IT services.

Why is impartiality important in cyber security?

Independent advice helps senior leaders understand whether existing controls are suitable, effective and proportionate without relying entirely on the organisations responsible for providing those controls.

An impartial cyber security adviser can identify gaps, challenge assumptions and help leadership teams ask informed questions of their IT department, managed service provider and other suppliers.

Who does Black Arrow work with?

We work with clients of different sizes across sectors and geographies, from financial services to non-profit organisations. These include regulated businesses, banks, investment management firms, insurance, fiduciaries and other financial services firms, professional services organisations, and membership-based organisations. We also work with non-executive directors and high net worth individuals.

Our approach is tailored to each client’s size, activities, regulatory obligations, technology, information, threat profile and risk appetite.

Where does Black Arrow operate?

Black Arrow is based in Guernsey and the UK, and supports clients in the Channel Islands, the UK, Europe, the Caribbean, the US and other geographies.

Our team’s experience spans multinational organisations, global financial services, government, British Intelligence, law enforcement, regulation and critical national infrastructure.

Cyber Security Risk and Governance

Is cyber security an IT responsibility?

Cyber security is not solely an IT responsibility. Technology is important, but effective cyber security also depends on leadership, governance, employees, business processes, supplier management, incident response and operational resilience.

The board and senior leadership remain responsible for ensuring that cyber risk is understood and managed, even where technology and security services are outsourced.

What is cyber security governance?

Cyber security governance is the system through which an organisation directs, oversees and holds people accountable for managing cyber risk.

Effective governance defines who makes decisions, how risks are assessed, what information is discussed by the board, how control providers are challenged and how security priorities are aligned with the organisation’s objectives, legal duties and risk appetite.

What is the board’s role in cyber security?

The board should ensure that significant cyber risks are understood, appropriately managed and aligned with the organisation’s overall risk appetite.

Directors are not expected to become technical experts. They should, however, understand the fundamentals of cyber risks, and the potential business consequences of a cyber incident. In their role, directors should receive meaningful reporting, question whether controls are effective and ensure that the organisation is prepared to respond and recover.

What cyber security information should a board receive?

Board reporting should explain the organisation’s principal cyber risks, important control weaknesses, significant incidents, emerging threats and progress against agreed priorities.

It should focus on business impact and decision-making rather than technical activity alone. Useful reporting helps directors understand what could go wrong, how prepared the organisation is and where leadership attention or investment is required.

How can directors challenge their IT provider on cyber security?

Directors can challenge providers by asking how the organisation’s most important cyber risks are being managed by controls, how controls have been independently tested and what evidence demonstrates that those controls are working. The controls should be formally agreed in a policy document, so that the conversation is objectively focused on whether the agreed controls are being maintained.

For example, directors should seek evidence on how quickly incidents would be detected, how access is controlled, whether backups are protected, how suppliers are assessed and how the organisation would continue operating during a serious disruption. The board should ensure they are upskilled sufficiently to challenge the information that they receive.

What does proportionate cyber security mean?

Proportionate cyber security means applying controls that reflect the organisation’s actual risks rather than adopting every available security measure.

The right approach will depend on the organisation’s size, sector, information, systems, regulatory obligations, threat profile and potential impact of disruption. Proportionality does not mean accepting weak security. It means prioritising investment where it will reduce risk most effectively.

What is the relationship between data protection and cyber security?

Data protection and cyber security are closely related, but they are not the same thing. Data protection relates specifically to information about a person (a ‘data subject’) and focuses on ensuring their personal information is collected, used, stored and shared lawfully. Cyber security considers how to protect the confidentiality, integrity and availability of all electronic data and systems of all types within an organisation, not just personal information.

There is a significant area of overlap, where cyber security helps organisations meet their data protection obligations for confidentiality, integrity and availability. However, cyber security does not address broader aspects of data protection such as privacy, transparency and the rights of data subjects. 

Cyber Security Assessments and Strategy

What is a cyber security gap analysis?

A cyber security gap analysis is an independent assessment of how an organisation currently manages cyber risk and where improvement may be required.

It considers existing controls across people, operations and technology, identifies weaknesses and provides prioritised recommendations. The purpose is to give leaders a clear, objective view of their position and a practical route towards improvement.

What does a Black Arrow cyber security gap analysis cover?

Our assessment considers governance, risk management, policies, employee awareness, identity and access, technology controls, supplier risk, incident response preparations, business continuity and other relevant controls.

The scope is adapted to the organisation and its risk profile. Findings are translated into clear, prioritised actions so that leadership teams can focus resources on the areas that matter most.

How often should a cyber security assessment be completed?

A comprehensive independent assessment should normally be considered periodically and whenever the organisation experiences significant change.

Triggers may include changes to technology, acquisitions, outsourcing, regulatory developments, rapid growth, major incidents or the introduction of important new services. Progress against previous findings should be reviewed more frequently to ensure agreed improvements are being delivered.

What is a cyber security strategy?

A cyber security strategy defines how an organisation will manage cyber risk in a structured manner to support its wider objectives.

It should establish priorities, responsibilities, desired outcomes and a realistic plan. An effective strategy addresses people, operations and technology and reflects the organisation’s risks, resources, regulatory obligations and tolerance for disruption.

Can Black Arrow review our existing cyber security strategy?

Yes. We can independently review an existing strategy, assess whether it addresses the organisation’s risks and determine whether its priorities are achievable and proportionate.

We can also help leadership teams develop a new strategy, establish a practical programme of work and define suitable measures for monitoring progress and reporting to the board.

Fractional CISO Support

What is a fractional CISO?

A fractional Chief Information Security Officer, or fractional CISO, provides senior cyber security leadership on a flexible, outsourced basis.

This gives an organisation access to strategic advice, governance support and specialist expertise without employing a full-time CISO. The arrangement can be adapted to provide ongoing support, assistance during periods of change, or leadership for a defined programme.

Does my organisation need a CISO?

An organisation may need CISO-level support when there is a need for dedicated focus to manage cyber risk, support regulatory compliance, oversee security strategy, and provide independent reporting to senior management and the board.

The decision point depends on the organisation's risk profile, complexity and regulatory obligations rather than its size alone. Where a full-time role is not required, a fractional CISO can bring similar benefits at a lower cost.

What does Black Arrow’s fractional CISO service include?

Our fractional CISO support provides experienced cyber security leadership on a part-time basis, sized to your needs. We provide support in identifying and prioritising cyber security risks, reviewing controls, developing policies, reporting to boards, supporting audits and regulatory requirements, overseeing remediation activities, and improving cyber resilience.

Rather than relying on one individual’s experience, clients gain access to Black Arrow’s wider team and its combined expertise across cyber security, threat intelligence, technology, governance, finance, human resources and regulation.

Will a fractional CISO replace our IT team or managed service provider?

No. A fractional CISO should complement existing teams and providers rather than replace them.

The role provides strategic leadership, independent oversight and informed challenge. Black Arrow can work collaboratively with internal IT teams, managed service providers, compliance teams, risk functions and senior leaders while maintaining the independence required to assess whether controls remain appropriate.

Cyber Incident Preparedness

What is a cyber incident response exercise?

A cyber incident response exercise is a structured simulation that allows an organisation to practise responding to a realistic cyber incident without placing live systems at risk.

The focus is on how the leadership team responds, drawing on resources to manage the impact across people, operations and technology. Participants work through developing events, make decisions and consider communications, legal, regulatory, operational and technical consequences. The exercise identifies assumptions, unclear responsibilities and weaknesses before they are exposed during a real crisis.

Who should participate in a cyber incident exercise?

Participants should reflect the functions that would be involved in a genuine incident. This may include senior leadership, IT, information security, compliance, legal, risk, communications, operations, human resources and relevant external providers.

Board members may also benefit from participating, particularly where an incident could cause significant operational, financial, regulatory or reputational harm.

How often should cyber incident response plans be tested?

Organisations should test their response arrangements regularly and following significant changes to systems, suppliers, personnel or business operations.

An annual exercise is a useful baseline for many organisations, although higher-risk or regulated businesses may need more frequent testing. Lessons from incidents, exercises and emerging threats should be used to update the response plan.

What is the difference between incident response and business continuity?

Incident response focuses on containing, investigating and managing the immediate cyber incident. Business continuity focuses on maintaining or restoring important business services while disruption continues.

The two disciplines must work together. A technically successful response may still result in serious harm if the organisation cannot communicate, serve clients, meet regulatory obligations or continue critical operations.

Penetration Testing and Technical Assurance

What is penetration testing?

Penetration testing is a controlled assessment in which qualified specialists attempt to identify and safely exploit weaknesses in systems, applications or networks.

The purpose is to determine whether vulnerabilities could be used by a real attacker and to provide practical recommendations for reducing that risk. Testing should be properly scoped, authorised and aligned with the organisation’s environment.

Is penetration testing the same as a vulnerability scan?

No. A vulnerability scan uses automated tools to identify known weaknesses. Penetration testing involves skilled human analysis to investigate whether weaknesses can be combined or exploited and what the likely consequences would be.

Both are useful, but they serve different purposes. The appropriate approach depends on the systems being assessed and the assurance the organisation requires.

What other security assessments do Black Arrow do?

As more organisations move to the cloud, other security assessments such as a Microsoft 365 configuration review become more relevant to identify risks that the organisation can proactively manage.

How often should penetration testing and other security assessments be carried out?

Assessments should be considered regularly, after major system changes and before launching important internet-facing services or applications.

The frequency should reflect the organisation’s risk, regulatory obligations, technology and rate of change. Assessments are most valuable when findings are prioritised, addressed and followed by confirmation that significant weaknesses have been resolved.

Employee Awareness and Phishing

Why is employee cyber security awareness important?

Attackers frequently target employees because persuading someone to click on an email link, open an attachment, disclose information, approve access or make a payment can be easier than overcoming technical controls.

Effective education helps employees recognise suspicious activity, understand their responsibilities and report concerns quickly. Employees should be treated as an important part of the organisation’s security controls, because they can interact with the attacker.

What makes cyber security training effective?

Effective training is relevant, understandable and connected to the situations employees may face in their work and personal lives.

It should explain why behaviours matter, use credible real-world examples and give people practical actions they can remember. Training should avoid unnecessary technical language and should be refreshed as criminal tactics and business processes change. Training should be based on a blended learning approach; we find that the most valuable part is in-person training where there is an engaging discussion on how security can apply in the organisation.

What is a phishing simulation?

A phishing simulation is an authorised exercise in which realistic but harmless messages are sent to employees to help them practise recognising and reporting suspicious communications.

The purpose should be educational for both the employee and the employer. Results can identify where further support is needed and help the organisation understand whether employees know how to report potential attacks quickly.

Does Black Arrow use a “gotcha” approach to phishing simulations?

No. Phishing simulations should be an opportunity to practise identifying and reporting suspicious emails; they should not be a bruising ‘gotcha’ where the punishment is more training.

The objective is clear: enable the employee to show they know how to report the suspicious email or, if they have fallen for it, then they quickly tell the employer and demonstrate muscle memory for when a real attack happens. We have a structured approach with our clients where employees are fully engaged after the exercise with learnings for the employer and employee, and both parties feel more fulfilled.

Threat Intelligence

What is cyber threat intelligence?

Cyber threat intelligence is analysed information about attackers, their methods, their targets and the risks they may present to an organisation.

Useful threat intelligence goes beyond collecting technical indicators or news stories. It helps decision-makers understand which developments are relevant, how the threat environment is changing and whether existing controls or priorities should be adjusted.

How does Black Arrow use threat intelligence?

Threat intelligence underpins our advice, assessments, training, incident exercises and strategic work.

Our team reviews current criminal, state-linked and emerging cyber activity and translates it into clear business implications. This helps clients focus on credible threats rather than reacting equally to every new vulnerability, headline or security product.

Can I receive Black Arrow’s cyber threat intelligence updates?

Yes. Black Arrow publishes a weekly Cyber Threat Intelligence Briefing for senior leaders and decision-makers.

The briefing provides a clear summary of significant cyber threats, vulnerabilities, regulatory developments and relevant industry news. It is designed to help readers remain informed without requiring a technical background. You can subscribe through our website.

Working With Black Arrow

What happens when we first contact Black Arrow?

We will begin by discussing your organisation, the issue you are trying to address and the outcome you need.

This initial conversation helps us understand how we can best support you, and give you options to consider. Based on your needs, we will work with you to define the scope, deliverables, timescale and commercial arrangements clearly before the engagement begins.

Can Black Arrow work with our existing advisers and service providers?

Yes. We regularly work alongside internal teams, managed IT providers, auditors, legal advisers, compliance specialists and other third parties.

Our role is collaborative but independent. We aim to help all parties understand priorities, responsibilities and required outcomes while giving the organisation’s leadership an impartial view of its cyber risk and controls.

Do you provide fixed projects or ongoing support?

We provide both. Some clients engage us for a defined assessment, workshop, security assessment, training programme or incident response simulation exercise. Others require ongoing strategic, governance or fractional CISO support.

The appropriate model depends on the organisation’s needs, resources, risk profile and the level of continuing support required.

How much do Black Arrow’s services cost?

Costs depend on the service, scope, complexity, timescale and level of specialist involvement required.

We define the proposed work and associated fees before an engagement begins. Our aim is to provide proportionate support that focuses resources on meaningful risk reduction rather than recommending unnecessary activity, products or technology.

Are conversations with Black Arrow confidential?

Yes. We recognise that cyber security discussions may involve sensitive information about systems, controls, incidents, employees and suppliers.

Information is handled carefully and only used for the agreed purpose. Appropriate confidentiality and contractual arrangements can be established before detailed or sensitive information is shared.