A staff member forwards you a suspicious email at 5pm on a Friday. Your IT provider tells you the firewall and the backups are fine. Then your insurer's renewal form arrives asking whether multifactor authentication protects remote access, and you find you can't answer with confidence. That gap between having IT support and being able to prove your controls work is where a cyber security consultant earns their fee.

A cyber security consultant assesses risk, advises on controls and, increasingly, runs security services for clients who have no internal security team. The job is part engineer, part translator, part accountability. What follows is what the role involves in practice, what deliverables you should expect, where the limits sit, and how to choose between hiring, retaining and partnering.

Cyber Security Consultant Services at a Glance

Consultancy is a defined industry in the UK, not a side activity. The Department for Science, Innovation and Technology's 2025 Cyber Security Sectoral Analysis identified 2,165 UK cybersecurity firms employing 67,299 full-time-equivalent workers in cyber roles, with sector revenue around £13.2 billion. Employment rose 11% from 60,689 in 2023, yet core cyber job postings fell 33% between 2023 and 2024. Clients aren't buying headcount. They're buying delivered outcomes.

That pressure has settled the work into six recognisable services. They overlap heavily, so one consultant may deliver several, and a single engagement usually starts with an assessment before moving into a retainer once the client sees the gap list.

Read the table against the problem you have today, not the one you fear most. An unknown exposure points to assessment: you can't fix what nobody has measured. A suspected breach points straight to incident response, because containment has a clock on it. A business where nobody is watching alerts, patch status or admin accounts at 2am points to managed services.

Practical rule: buy the service that answers this week's question. Retainers are easier to justify once an assessment has shown you what the retainer will actually supervise.

What a Cyber Security Consultant Does Day to Day

Think of a consultant as a building surveyor who also checks the locks, the alarm and what staff do with the fire doors. The written report matters, but the value comes from telling you which cracks are structural and which are cosmetic.

A week inside a mid-sized engagement follows a recognisable shape. Monday is a kick-off call to agree scope and confirm what's out of bounds. Tuesday and Wednesday go on asset lists, administrator accounts and configuration exports pulled from the endpoint tool, the firewall and the cloud tenant. Thursday is interviews: the operations lead who knows how the warehouse system talks to the finance package, the finance manager who approves supplier payments, the office manager who resets passwords when people forget them. Friday is a workshop where findings get explained in plain language, followed by a report with a prioritised action list.

Advising Is Not Doing

The consultant sets direction and checks the result. Internal IT, or the MSP already holding the support contract, usually makes the changes. That division matters commercially: if the same person recommends work and bills for delivering it, the assessment stops looking independent and starts looking like a quotation.

The skills that matter in the middle of that week are narrower than job adverts suggest. Reading network and identity configuration well enough to spot a shared admin login or a rule nobody remembers adding. Translating technical risk into business impact so a director understands that a dormant account with domain admin is a payment-diversion risk, not an abstract finding. Writing findings a non-technical board can act on, with the fix, the owner and the deadline in the same line.

A consultant who can't be understood by the person holding the budget isn't consulting. They're producing an artefact.

Where the Role Stops

A consultant cannot sit in your office every day. Daily habits stay with your staff: reporting suspicious emails, refusing to approve a bank change on the strength of an email alone, locking a laptop when they leave a desk. The best engagements hand those habits to an internal owner with a name and a calendar reminder.

If you're an MSP reselling consultant time, nail down who owns the client. The consultant advises, your business holds the commercial relationship, and the customer should never be left wondering which of you to call. Blur that line and you spend the next renewal defending work you didn't scope.

How Consultants Assess Your Security Baseline

A baseline gives an owner or MSP a practical answer to three questions: what assets exist, which controls are in place, and what needs attention first. Policies describe the intended setup; configuration and access records show what is running.

The Cyber Security Breaches Survey 2025 found that 77% of businesses used up-to-date malware protection, down from 83%, while 68% restricted administrative rights, down from 73%. These figures make a useful prompt for checking a specific organisation, not a substitute for that check. A consultant needs to confirm which devices are protected and whether privileged access is properly restricted.

The Six Checks That Build the Picture

1. Build an asset inventory covering laptops, servers, cloud tenants and mobile devices. Unknown devices are easy to miss in security checks. Start with available records, then reconcile them against management tools and accounts in use.
2. Review privileged accounts and remove dormant or shared administrator logins. Shared credentials make it harder to attribute actions; dormant accounts may retain access long after someone leaves. Record the account owner and the reason each privileged account remains active.
3. Check endpoint management reports for unmanaged devices and missing protection. Compare enrolled devices with the organisation's asset records. A gap may mean a device is unprotected, or that the inventory is incomplete.
4. Confirm multifactor authentication is enforced for email, remote access and admin portals. Check the actual policy and its coverage, rather than relying on whether the setting is available to users.
5. Test that backups restore, not just that jobs complete. Restore a folder or database to a clean machine and record whether the result is usable. A successful backup job alone does not confirm recovery.
6. Review firewall and remote-access coverage, including forgotten routes. Check whether VPN profiles, test rules and contractor access still have a valid owner and business purpose. Document any route that should be closed or restricted.

For small businesses, Cyber Essentials offers a recognised baseline without requiring a full ISO 27001 programme. It prompts review of areas such as devices, patching, access and malware protection, but does not assess every security risk. A consultant can use the GoSafe cyber risk assessment steps to help structure the initial review.

Turning Findings Into a Ranked List

Rank findings by how an attacker could use them and what access they would provide. An exposed service with a missing patch or an administrator account without multifactor authentication may need urgent attention. Then address weaknesses that could increase the impact of a compromise, such as untested restores or excessive access. Record lower-priority tidy-up work separately.

For patching, record when an update became available, when the affected system was exposed, when the fix was applied and any approved exception. Separate internet-facing, privileged and business-critical systems so that an overall average does not hide a high-risk asset.

A consultant should leave the business or MSP with a prioritised register, evidence for each finding, a proposed owner and a target date. That makes follow-up work assignable and billable, whether the consultant is hired for a fixed assessment, retained for recurring reviews or supplied through an MSP partnership. Agree who approves remediation and who covers urgent issues outside business hours; those responsibilities depend on the engagement, not on the assessment itself.

Typical UK business baseline control figures from the 2025 Cyber Security Breaches Survey:

How to Run Incident Response After a Suspected Breach

A suspicious login appears late on a Friday. The business does not yet know which records may be involved, whether the account was accessed, or whether its password is reused elsewhere. Start by establishing facts and preserving evidence. A clear, timestamped record makes it easier for the client to make decisions and for a consultant to explain what happened.

A Workflow That Holds Up Under Pressure

1. Validate the alert and identify the affected account or domain. Review sign-in logs, mailbox rules and recent password changes. A phishing report and a genuine account compromise require different responses, so establish what the available evidence shows.
2. Contain the threat while preserving evidence. Isolate the account, revoke active sessions and tokens, and block the route used. Avoid wiping a device before considering what evidence it may hold.
3. Identify the users and data that may be involved. Trace the account's access to systems and the records those systems hold. This information supports the client's assessment of whether personal data is affected.
4. Take account-level actions. Reset compromised passwords, enable multifactor authentication, review affected accounts and notify relevant personnel. Investigate suspicious activity and record each action.
5. Brief the client's data protection lead or management team. Separate confirmed facts from unknowns, and identify the decisions that remain. Keep the briefing concise and dated.
6. Record the notification decision. Document who made the decision, when they made it and what evidence informed it.
7. Maintain a timestamped incident log. Record actions, people involved and times from the outset. A consultant can help keep this record orderly, but the client remains accountable for its decisions.

The 72-Hour Clock and Who Owns It

Under UK GDPR, a controller must notify the ICO of a personal data breach within 72 hours of becoming aware of it, where feasible, unless the breach is unlikely to result in a risk to people's rights and freedoms. The government model action plan for responding to significant data breaches sets out a response process. A processor that discovers a breach must notify the controller without undue delay.

An alert about an exposed email address or password can give a business an earlier opportunity to investigate what information may be affected. A consultant can support triage and escalation, but monitoring does not replace legal assessment or the client's notification decision.

The client retains responsibility for deciding whether to report. The organisation's Data Protection Officer is responsible for reporting a qualifying breach to the ICO within 72 hours. The consultant's deliverables should make the decision easier to take: a clear timeline, evidence gathered, systems and data under review, actions completed, and open questions.

A common operational gap is a log that begins after the incident. Reconstructing a timeline from memory and scattered messages makes decisions harder to defend. GoSafe's Incident Response module helps businesses manage actions to consider after a suspected or confirmed security incident. For a practical overview of response steps, see the GoSafe incident response playbook.

Managed Security Services and Ongoing Monitoring

A retainer buys continuity: a fixed monthly fee for monitoring, alert handling, patch oversight, periodic reviews and a named person who reports against agreed metrics. It isn't a helpdesk ticket with a security label. The deliverable is a rhythm of evidence.

Picture the monthly report for a 40-user professional services firm. It lists privileged accounts reviewed and any dormant ones disabled, open alerts by severity and their current state, patch status for internet-facing systems, training completion by team, and the one or two items the client still owns. Twelve of those reports in a row tell a story an insurer, a client's customer or a bid evaluator can read.

Say What Monitoring Doesn't Do

Dark web monitoring does not prevent cyberattacks and does not replace endpoint protection, multifactor authentication, firewalls or other preventive security controls. Put that in the contract and repeat it in the report. A partner who oversells monitoring as protection spends the first real incident explaining what the service was never meant to cover.

Contract language that saves arguments: monitoring detects exposed information and supports triage. Containment, prevention and recovery remain covered by the controls listed in the schedule.

What monitoring does well is trigger action. An exposed credential should set off a defined chain: confirm the account still exists, force a reset, check that multifactor authentication is enforced for that user, review recent sign-ins for anomalies, and log the whole sequence. That turns an alert into a documented response rather than an email someone forwards to IT and forgets.

This model fits businesses that have no internal security team and no realistic prospect of building one. It also fits MSPs better as one component of a wider managed service than as a separate product with its own invoice, because the customer already trusts one provider to hold the operational relationship.

Three Questions Before You Sign

Official guidance on principles for securing personal data in government services recommends that organisations define clear incident-escalation roles, maintain a response team for incidents that could involve personal data, and keep the threshold for seeking ICO involvement low where there's uncertainty. Ask any provider the same three questions in plain terms:

• Who receives an alert, and how quickly is it reviewed? A named role, not a shared inbox nobody reads at weekends.
• What happens out of hours? If the answer is nothing, you're buying weekday monitoring at a seven-day price.
• What's excluded from the retainer? Forensic investigation, legal advice, ransomware negotiation and full incident response usually sit outside it. Get that in writing before the incident, not during it.

Choose a Hiring Model and Confirm Your Next Step

The labour market answers part of this question for you. DSIT's Cyber Security Skills in the UK Labour Market 2025 reports that approximately 143,000 people were employed in cybersecurity roles across the UK economy in 2024, a 5% increase on the previous year. The estimated workforce gap was still around 3,800 professionals, and 49% of UK businesses reported a basic technical cybersecurity skills gap, with 30% reporting deficiencies in more advanced technical skills.

Recruiting a full-time security lead into that market is slow and expensive for a business that isn't a security company. The practical question isn't "should we hire?" but "which arrangement matches our actual workload?"

Read the Table by Workload, Not by Job Title

An in-house hire suits a business where security work arrives every day and someone needs to own it permanently. A fractional consultant suits a company that needs a defined number of days a month, often a virtual CISO arrangement, without the recruitment risk. A retainer buys ongoing advice with agreed response times, which is the difference between "we can ask someone" and "someone answers within four hours".

An MSP with an embedded security service suits most SMBs, because they're already buying support and the security work rides on an existing relationship. An incident response firm on call is the fire brigade: rarely needed, expensive when it is, and worth having in a drawer. The differences between the two provider types are worth understanding before you compare quotes, and the MSP vs MSSP differences explained guide covers where the boundary sits.

Most organisations combine two models. An MSP handles monitoring and day-to-day response while an independent consultant runs an annual assessment and challenges the results. The separation is healthy: someone checks the work of the people doing it.

If you do decide to hire internally, work through these strategies for recruiting security professionals before the job advert goes out. A vague security role attracts candidates who talk well and deliver little.

Decision rule: if you can name the problem, buy the matching service. If you can't, buy an assessment first and let it tell you what to buy.

Terms to Settle in Writing

Whatever you choose, agree three things before signature: what's covered, who answers out of hours, and how results are reported. Vague coverage is the source of most disputes, and "reasonable endeavours" is not a response time. Ask for the report template too, so you know whether you'll receive a dashboard screenshot or something a board can discuss.

For MSPs and telecom resellers, the same test applies to recurring revenue. A monthly service sold under your own brand is far easier to justify when ownership, escalation and reporting are settled. GoSafe is a dark web monitoring tool that slots into that service layer: alerts written for business users, fully white-label so you sell it under your own name, no specialist security knowledge or complex setup required, and the customer relationship stays yours. It's Cyber Essentials accredited, and it does not prevent attacks, so it sits alongside the controls a consultant recommends rather than replacing them. View the GoSafe reseller programme to see how the platform works for service providers.

Exposed credentials are one of the few risks you can find before an attacker uses them, and most businesses never look. GoSafe Dark Web monitoring scans the dark web continuously for leaked passwords, breached domains and exposed email addresses, then delivers clear alerts your customers can act on without a security team. If you'd rather sell that capability under your own brand than build it, visit GoSafe Dark Web monitoring to see the platform and what a real finding looks like.