Cybersecurity advisory for high-stakes decisions.
Straylight brings an experienced practitioner’s perspective to threat intelligence data, tools, and capability decisions. We support management consultancies, investors, and security leaders through expert consultations and scoped advisory.
Straylight brings the perspective of the people who use and buy intelligence: building capabilities, tracking adversaries, evaluating data and products, and deciding what will work in practice.
We connect requirements, data quality, analyst workflows, and tooling to the outcomes a team needs to deliver.
A practitioner’s perspective on threat intelligence data and tools.
For management consultancies, investors, and security teams seeking to understand how cyber threat intelligence data and tools are selected, evaluated, and used. A focused expert consultation can explore the market, buyer priorities, and the operational trade-offs behind a decision.
Data value and quality
How coverage, provenance, freshness, and context affect usefulness. Where sources overlap, how teams assess gaps, and why more indicators do not necessarily produce better intelligence.
Tools and buying decisions
How teams evaluate providers and platforms, weigh build-versus-buy choices, and test vendor claims. The role of workflow fit, integration effort, cost, and analyst capacity in adoption.
Operational use
How intelligence supports investigation, detection, prioritisation, and leadership decisions. What makes data usable within an existing operation, and where adoption commonly runs into difficulty.
Start with a focused expert consultation
Share the topics you want to explore and the purpose of the discussion. We agree the scope and screen for conflicts before the call. Discussions draw on professional experience and public information.
Where a deeper assessment is useful, a separate review can provide an evaluation scorecard, gap assessment, or recommendations.
Discuss an expert consultationMost useful when the decision is important, the claims are difficult to test, and the cost of getting it wrong is high.
01Are our threat intelligence data and tools meeting the need?
Assess source coverage, data quality, analyst workflows, and integration gaps against the intelligence requirements the team needs to satisfy.
02Is this cyber company technically and commercially credible?
Evaluate technical claims, market positioning, and customer evidence against what serious security buyers will actually scrutinise.
03What capability do we actually need, and what should we not buy?
Define requirements from first principles, assess what vendors are offering, and identify what to decline before commitments are made.
04Will this intelligence function produce decision-grade output?
Assess operating model, workflow, tooling, governance, and team structure against the outputs the function is expected to produce.
05Where are vendor claims, procurement assumptions, or internal plans likely to fail?
Map the assumptions underneath the plan and test each one against operational reality before capital or mission outcomes are committed.
Advisory from the buyer side, regardless of who's in the room.
For founders preparing for serious buyers.
Founders and leadership teams preparing for enterprise, industrial, government, or national-security buyers who will test claims hard.
Typical focus: positioning, proof-of-concept readiness, buyer objection mapping, procurement narrative, GTM pressure-testing.
Engage before a major sales push, government-market entry, strategic partnership, fundraise, or board positioning decision.
For teams seeking an informed practitioner view.
Management consultancies and investors researching cybersecurity markets, products, buying behaviour, and the practical use of threat intelligence data and tools.
Typical focus: expert consultations, market and buyer perspectives, data and tooling evaluation, technical credibility, and adoption risk.
For a focused research call, a client assignment, or a deeper diligence question.
For teams making intelligence capability decisions.
Security and intelligence teams across enterprise, public sector, and critical infrastructure choosing data, tooling, suppliers, and operating models.
Typical focus: intelligence requirements, data quality and coverage, tooling evaluation, integration, and operational fit.
Before a new data subscription, platform purchase, renewal, or intelligence programme redesign.
Four common engagements. Each is principal-led, scoped around a specific decision, and designed to produce clear outputs.
Threat Intelligence Data & Tooling Review
For teams choosing, integrating, or reviewing intelligence data and tools.
- Intelligence requirements and use-case brief
- Data coverage, quality, and gap assessment
- Vendor and tooling evaluation scorecard
- Workflow and integration recommendations
- Prioritised implementation roadmap
Buyer Readiness Review
For cybersecurity startups preparing for serious buyers.
- Positioning pressure-test and gap assessment
- Buyer objection map
- Proof and credibility gap assessment
- Procurement narrative recommendations
- Messaging and positioning changes
Investor Diligence
For funds evaluating cybersecurity deals.
- Expert call or written diligence memo
- Technical claim pressure-testing
- Buyer adoption risk assessment
- Market and competitive landscape read
- Red flags and follow-up diligence directions
Retained Strategic Advisory
For leadership teams facing consequential decisions.
- Monthly or quarterly advisory sessions
- Board or executive counsel
- Product, market, and capability reviews
- Consequential decision support
- Discreet counsel and scenario planning
Experience shaped by building, tracking, and evaluating.
Built a threat intelligence practice from zero
Defined the service offering, hired and led the team, created the initial client pipeline, and grew it into a revenue-generating capability.
Led intelligence response to nation-state campaigns
At Microsoft, built and operated threat intelligence and response operations directly shaping defensive posture for a global customer base facing Russia's most capable state-sponsored threat actors.
Evaluated security platforms from the buyer side
Led comparative assessments of threat intelligence and security products, balancing analyst need, operational fit, procurement reality, and cost-benefit across multiple vendor cycles.
Advised CISOs and intelligence leaders
Provided counsel to security and intelligence leaders across energy, manufacturing, transport, and government on capability design, supplier evaluation, and strategic programme decisions.
Engaged national security and government stakeholders
Led national-security-level engagement with various NCSCs, NATO, CERT-EU, and ENISA — translating operational threat intelligence into policy-relevant briefings for allied governments, regulators, and critical infrastructure programmes. Led RFP participation for a NATO body, securing the initial contract.
Principal-led advisory. Direct judgement.
Limited engagements
We intentionally limit active work to a small number of concurrent engagements to preserve principal-level involvement and focused delivery.
Direct engagement
You work directly with the principal throughout the engagement. Scope, responsibilities, confidentiality, and any client or partner involvement are agreed before work begins.
Clear outputs
The scope defines the output from the outset: an expert consultation, a written assessment, recommendations, or a broader advisory engagement.
Conflict screening
We screen every engagement upfront for conflicts of interest and work with one side per engagement. Any concerns are raised before substantive discussion begins.
Built from the buyer side
Our experience spans building programmes, tracking adversaries, and leading procurement evaluations. Recommendations are grounded in how intelligence is produced and used.
The judgement behind every engagement.
Direct access.
Clear judgement.
Defined outputs.
Two decades building intelligence capabilities, tracking adversaries, advising security leaders, and evaluating cyber capability from the buyer side. Background spans UK government intelligence, the Microsoft Threat Intelligence Center, and industrial cybersecurity leadership.
Experience advising CISOs, intelligence teams, and senior leaders across government, energy, manufacturing, transport, and technology on capability design, supplier evaluation, and high-stakes strategic decisions. Work focused on the intersection where technical claims, operational reality, and consequential decisions meet.
Recognition. Speaker at NATO CTI Conference, various NCSCs, CERT-EU, ENISA, Black Hat Europe, Microsoft BlueHat, SANS CyberThreat, and closed-trust intelligence forums. Quoted in WIRED, BBC, TechCrunch, The Register. Published in Computer Weekly and the Microsoft Security Blog.
Start with a confidential conversation.
For an expert consultation, share the topics you want to cover, the purpose of the discussion, and your preferred timing. For a larger review, outline the decision and the data or tools involved. We confirm fit, scope, and conflicts before substantive discussion.
Send an enquiryExpert consultations · Threat intelligence data & tools · Cyber advisory
All enquiries are treated as confidential. Conflict checks are available before substantive discussion begins. Secure communications can be arranged.
Serious enquiries are normally reviewed within one business day.