A consultancy built around continuity
Zolvair Security was founded by practitioners who had spent years watching sound recommendations fail in implementation. We structured the firm so that the people who identify a problem are accountable for resolving it.
Security is not a checklist
Every organisation has different business objectives, technologies, risks and operational constraints. A control set that is appropriate for a regulated bank is frequently wrong for a manufacturer with thirty years of operational technology on the factory floor.
We begin by understanding the business, its critical assets, architecture and operational dependencies, and only then discuss controls. Context matters more than generic frameworks, and it is the part most often skipped.
Compliance is important. Compliance alone does not make an organisation secure. Our work is measured by real business risk reduced, not by audits passed.
How we work
Context before controls
We do not recommend a control until we can explain which business outcome it protects and which failure mode it addresses.
Proportion
Security spending competes with everything else the organisation needs to do. Our recommendations are sized to the risk, not to the budget available.
Plain language
If a risk cannot be explained to an executive without jargon, it has not been understood well enough to be presented.
Evidence over assertion
We separate what we have verified from what we infer, and we say which is which in every report we issue.
Independence
We hold no reseller agreements. Tooling recommendations follow from the requirement, and doing nothing is a legitimate recommendation.
Durability
A control that your team cannot operate will decay. We design for the staffing and skills that will actually be in place.
The people
Our consultants have held security leadership positions in financial services, healthcare, industrial operations and technology firms. Several have run incident response for organisations under regulatory scrutiny; others have spent their careers building the platforms they now assess.
We deliberately keep the team small. Engagements are led by the person who scoped them, and we decline work when we do not have the right experience available. That constrains our growth, and it is the reason our clients stay with us across years rather than projects.
Start with a conversation, not a proposal
We begin by understanding your business objectives, architecture and constraints. If we are not the right fit, we will say so.