Independent Cyber Resilience & AI Governance Advisory

When the risk is clear, but the decision isn't.

I help leadership teams turn cyber and AI risk into clear business priorities, accountable ownership and decisions they can act on.

Cyber resilience, AI governance, executive crisis readiness and NIS2 — grounded in what the business needs to protect, enable and keep moving.

Assess Your Cyber Resilience → Explore Advisory Services

15 questions · about 10 minutes · free · personally reviewed by André

20+ years in technology & security leadership · CISM · ISACA Author · Two-time Cyber Leadership Institute Capstone Winner

The business doesn't feel a control gap. It feels what happens next.

Operations

A critical supplier goes down. Which business service stops first?

AI in use

AI is already being used across the organisation. Who approved it, what can it access and who owns the risk?

Prioritisation

An assessment identifies 27 gaps. Management has one budget and limited capacity. What matters first?

Different situations. Same leadership problem.

What could materially affect the business? Who owns it? What can we tolerate? And what needs a decision now?

That is where I work.

I start with the business. The framework comes after.

What must keep working? What creates value? What could disrupt operations, customers, revenue or trust? What can leadership tolerate?

Standards and regulations matter. They provide structure, evidence and discipline. But they are means, not the outcome.

The framework should inform the decision. It should never become the decision.

Three areas. One principle.

Governance should help the business make better decisions, not create more distance from them.

Cyber Resilience

Keep the business moving when conditions change.

Understand what matters, where critical dependencies sit, who owns the decisions and whether leadership can act under pressure. Strategy, governance and executive tabletop exercises turn resilience from a plan into something the organisation can use.

Learn more →
AI Governance

Adopt AI without losing control of material decisions.

When AI adoption outruns governance, the first questions are practical: What are we using? Who owns it? What can it do? What risk are we accepting? When must a human intervene? I help put visibility, accountability, risk management and clear decision rights around AI so organisations can adopt it responsibly and with confidence.

Learn more →
NIS2 Governance Readiness

Make management responsibility operational.

A gap assessment alone does not create ownership, oversight or evidence. I help turn regulatory requirements and findings into priorities, named owners, practical actions and governance that management can stand behind. The result should be more than compliance: clearer governance and a more resilient business.

Learn more →

How an engagement can begin.

Not every organisation needs the same thing. These engagements are common starting points, not an exhaustive list. If your situation is different, we begin with the decision you need to make.

My job is not to make the problem sound more complicated. It is to make the next decision clearer.

I start by understanding what the business needs to protect, enable or change. Then I test assumptions, accountability, dependencies and priorities until leadership can see:

what matters → who owns it → what should happen next

The output depends on the decision in front of you. It may be an executive brief, roadmap, governance structure, workshop, assessment or tabletop exercise.

The deliverable follows the decision. Not the other way around.

Independent judgment has to be earned.

Phil Zongo, CEO & Co-Founder, Cyber Leadership Institute
“Andre’s exceptional ability to connect cybersecurity with business strategy, develop practical and high-impact solutions, and communicate a compelling vision with clarity, confidence and persuasion.”
Phil Zongo · CEO & Co-Founder, Cyber Leadership Institute

Phil Zongo also notes that André is one of only two people in the Institute's history to win both the Cyber Leadership Program and Cyber Strategy & Transformation Program Capstones.

Free Cyber Resilience Assessment

Before you buy advice, experience how I think.

Start with the free Cyber Resilience Assessment, provided jointly by [it+]sm and André Porsch Consulting.

Fifteen practical questions take approximately 10 minutes.

From there, I take over personally.

I look beyond the individual answers to understand the overall picture, challenge inconsistencies and identify where attention could make the greatest difference.

Within 24–48 hours, you receive a written assessment tailored to your organisation.

Not just a score.

A professional second opinion on where you stand and what deserves attention next.

Take the Free Cyber Resilience Assessment →

15 questions · approx. 10 minutes · free · no sales call required

The link takes you to the joint [it+]sm and André Porsch Consulting assessment site.

The Cyber Resilience Assessment incorporates elements of the Five Anchors of Cyber Resilience developed by Phil Zongo and is used with permission.

The person behind the advice

I'm André Porsch, a Cyber Resilience and AI Governance Advisor with more than 20 years of experience across technology, security and leadership, including over a decade supporting operations for the Defense Commissary Agency (DeCA), a component of the U.S. Department of Defense.

My work sits between technical risk and business decision-making: helping leaders understand what matters, establish clear ownership and decide what should happen next.

I am a CISM, ISACA author and two-time Cyber Leadership Institute Capstone Winner, having won both the Cyber Leadership Program and Cyber Strategy & Transformation Program Capstones. I work directly with every client from the first conversation through delivery.

More About André →
André Porsch

Thinking beyond the checklist.

My published work with ISACA explores the leadership questions behind cyber resilience: ownership, trust, crisis readiness, culture and the decisions organisations have to make when controls alone are not enough.

Selected ISACA writing

You may already know what the problem is. The harder question may be what to do about it.

If you already have an assessment, audit, risk register or AI analysis but still lack confidence about what matters, who owns it or which decision comes next, that is where we can start.

Assess Your Cyber Resilience → Speak with André

No generic sales presentation. Just a useful first conversation about the decision in front of you.