Technology problems rarely stay technical.
For more than 20 years, I have worked where technology, operations and people meet.
I have led teams, supported business-critical systems, worked through incidents and operational disruptions, and seen what happens when the technical problem reaches the people who have to make the decision.
Today, I bring that experience to cyber resilience and AI governance, helping leadership teams understand what matters, establish clear ownership and decide what should happen next.
Before governance became my work, operations was.
My career did not begin with a framework.
It began in service and operations, leading teams and solving problems that affected customers, people and day-to-day delivery.
Over time, the work became more deeply technical as I moved into enterprise technology support.
From 2014, I worked for service providers contracted to IBM. In those roles, I spent more than a decade supporting technology operations for the Defense Commissary Agency (DeCA), a component of the U.S. Department of Defense.
That work included business-critical systems, escalated incidents, operational continuity and stakeholder coordination across U.S. military installations.
As a team leader, I supported the DeCA Europe Area Office and 32 European commissary locations. I also participated in global incident support covering more than 220 stores during overnight hours in the United States.
Later, as Europe Area Representative, I increasingly worked across technical teams and operational stakeholders to understand what had happened, what was affected, who needed to know and what needed to happen next.
An incident ticket is rarely where the problem ends.
A system goes down.
Technically, the problem may sit in an application, a network connection or a piece of hardware.
Operationally, the questions become different:
What has stopped working?
Who is affected?
How long can it stay unavailable?
Who needs to be involved?
What can be restored safely?
When does the issue need to move beyond the technical team?
Years of working in operational environments taught me that resilience depends on more than fixing the technology.
It depends on priorities, ownership, communication and decisions.
That lesson now underpins much of my advisory work.
My focus changed. The underlying problem did not.
Over time, I deliberately shifted my focus towards cybersecurity, risk, resilience and governance.
The questions became broader.
Not only:
How do we fix this?
But:
What risk does this create for the business?
Who owns that risk?
What should leadership do about it?
How do we know the organisation is actually prepared?
I deepened that work through professional cybersecurity certification, executive cyber leadership programmes and practical strategy work.
Today, my focus is not on making technical risk sound more complicated.
It is on helping the people accountable for the business make better decisions about it.
Strategy has to work beyond the slide deck.
I am a Certified Information Security Manager (CISM) and an ISACA author writing about cyber resilience, leadership, crisis readiness, culture and governance.
I am also a two-time Cyber Leadership Institute Capstone Winner, having won both:
Cyber Leadership Program
Cyber Strategy & Transformation Program
The Capstone projects require participants to develop executive-level cyber strategies, transformation plans and business cases, then present them to board-level panels.
Phil Zongo, CEO & Co-Founder of the Cyber Leadership Institute, describes the significance this way:
“Andre is one of only two people in the history of the Cyber Leadership Institute to win both the CLP and CSTP Capstone Projects. This achievement reflects far more than deep technical expertise. It demonstrates Andre’s exceptional ability to connect cybersecurity with business strategy, develop practical and high-impact solutions, and communicate a compelling vision with clarity, confidence and persuasion.”Phil Zongo · CEO & Co-Founder, Cyber Leadership Institute
The person you speak with is the person doing the work.
André Porsch Consulting is intentionally an independent advisory practice.
When we work together, there is no hand-off from a senior sales conversation to a junior delivery team.
I am involved from the first discussion through the analysis, challenge, workshops and final recommendations.
That matters because much of this work depends on context.
Understanding why one risk matters more than another.
Recognising when an ownership problem is hiding behind a control problem.
Challenging an assumption without losing the people who need to act on it.
Knowing when another document will help and when the organisation actually needs a decision.
I use technology and AI where they improve the work.
I do not outsource the judgment.
“André particularly helped me prioritise cyber risks by business impact, translate technical findings into clear business risks, and produce compelling executive reports. We also worked on ownership and on turning gaps into business decisions.”Kosae Alhussin · Senior Information Security Specialist Translated from the original German
I start with the business. The framework comes after.
There is no shortage of standards, regulations, controls and frameworks for cybersecurity and AI governance.
They matter.
But the organisation still has to decide:
What must keep working?
What matters most?
What can we tolerate?
Who owns the risk?
Where does leadership need to intervene?
The framework gives those decisions structure.
It should not replace them.
That is why my work tends to sit between technical risk and business decision-making.
It is also why I care more about whether a recommendation can be acted on than whether the deliverable looks impressive.
Writing forces the thinking to survive outside the room.
My published work with ISACA explores many of the same questions I work on with organisations:
- how leadership prepares for a cyber crisis,
- what happens when control fragments across suppliers and systems,
- how ownership shapes resilience,
- and why culture changes when leaders change the questions they ask.
I write because explaining an idea clearly is a useful test of whether the idea is clear in the first place.
Selected ISACA writing
- Three Simple But Powerful Strategies to Radically Transform Cybersecurity Culture →
- Three Penetrating Leadership Questions to Create a Cyber Resilient Culture →
- When Control Fragments: Rethinking Resilience in a Distributed World →
- Three Highly Actionable Steps to Strengthen Your Leadership Team’s Cyber Crisis Readiness →
The difficult part is often not seeing the risk.
It is deciding what to do with it.
The technical analysis may already be available. If ownership, priority or the next decision remains unclear—whether in cyber resilience, AI governance or NIS2—that is a useful place for us to start.
No generic sales presentation. A practical first conversation about the decision in front of you.