# Cyber security consulting with a clear plan for action. > Security strategy, architecture and resilience consulting with Robert Ressl. Define priorities, responsibilities and evidence before changes begin. When policies, architecture and operational risks pull in different directions, Safematix helps you decide what to address first. Work directly with Robert Ressl on a defined review, roadmap or implementation task—with agreed deliverables, responsibilities and a way to verify the result. ## A flexible, senior-led format. - **Direct expertise:** Work directly with Robert Ressl from scope through evidence and handover. - **Delivery:** Remote worldwide or on-site by arrangement, with secure communication agreed in advance. - **Modular scope:** Assessments, architecture reviews, workshops, implementation support, and focused retests. - **Commercial clarity:** Written objectives, deliverables, responsibilities, and fee before work begins. ## Start with the decision you need to make. You do not need a complete security programme before contacting Safematix. A specific change, unresolved finding or uncertain operational responsibility can be enough to define a useful engagement. ### You are changing a platform or architecture A cloud migration, new integration or AI system introduces questions about data, access and operations. Safematix can review the proposed design before decisions become difficult to reverse, documenting trade-offs and the controls that need an owner. ### You have findings, but no agreed order of work Assessment reports and risk registers can leave teams with a long list of issues and competing priorities. Safematix helps turn selected findings into a practical sequence, with dependencies, responsibilities and a clear basis for deciding what happens first. ### Your policies and daily practice no longer match Your security management system may describe controls that work differently in production. A focused review connects policy, architecture and available evidence, helping you distinguish missing documentation from controls that need a technical or organisational change. ### Your response or recovery plan needs a reality check Roles, escalation paths and restoration assumptions should be understood before an incident. Safematix can review the selected plans and run an agreed exercise, making unresolved decisions visible without presenting preparation work as an emergency-response retainer. ## Connect security requirements with how your organisation works. The engagement selects the relevant work below. Safematix does not assume that every organisation needs a new framework, another policy set or a complete redesign. ### Security strategy and governance Safematix translates selected risks and requirements into security priorities, responsibilities and decision points. Work can include an information security management system—ISMS—policies, third-party risk or a NIST-based roadmap, with a clear explanation of what each control is intended to achieve. ### Architecture and security design We review how identities, data and services interact across cloud, network, OT/IoT and AI environments. The output explains trust boundaries, access decisions, dependencies and design alternatives, so technical teams and decision-makers can discuss the same risks. ### Incident and recovery readiness Safematix helps develop or review response procedures, escalation paths, crisis communication and recovery plans. Tabletop exercises and selected backup or restore checks can examine whether the agreed approach is usable; their scope and operating constraints are confirmed beforehand. ### Assessment and implementation support We compare selected controls with available evidence, identify gaps and help define remediation. Where included in the written scope, Safematix also develops implementation materials or works alongside your teams, keeping recommendations, authorised changes and verification results distinct. ## Outputs your teams can use—not just a list of recommendations. The written scope selects the relevant deliverables below. A focused architecture review does not automatically include a complete policy set, recovery exercise and implementation programme. ### Current-state and risk summary A concise account of the systems, responsibilities and assumptions reviewed, supported by the evidence made available. It identifies the decisions the engagement can support and the questions that remain outside its scope. ### Architecture or control review Documented observations about the selected design or controls, including relevant data flows, access paths and dependencies. Findings explain their practical significance and distinguish observed conditions from assumptions that still need confirmation. ### Prioritised roadmap with ownership A sequence of proposed actions with their rationale, dependencies and intended owners. The roadmap separates immediate decisions from later work and gives your organisation a basis for agreeing resources, timing and acceptable residual risk. ### Agreed implementation materials Depending on scope, this may be an architecture decision record, policy, response runbook or workshop output. Materials describe how the proposed control should work, who operates it and what must be checked before it is treated as implemented. ### Verification and remaining-risk record A record of the agreed reviews, checks or exercises and their results. It distinguishes verified changes from open actions, documents remaining assumptions and provides a practical handover for the people responsible for continued operation. ## Technical experience behind the advice. You work directly with Robert Ressl. His public CV and engineering portfolio document systems architecture, offensive security and AI infrastructure; these are descriptions of his background, not invented customer outcome claims. ### Systems architecture and operations Robert’s public CV spans more than 20 years in systems, including Linux engineering, DevOps, cloud architecture and security consulting. His portfolio also documents operating a Kubernetes inference platform and his own network, connecting architectural choices with operational constraints. ### Regulated offensive-security delivery His public CV documents global offensive-security leadership and work in FINMA, DORA and TLPT environments. This is experience with regulated delivery—not regulatory approval, independent certification or a guarantee that a client’s organisation meets its obligations. ### AI engineering and system controls Robert publishes model artifacts and documents inference engineering. His public AI-security work includes MCP tooling and controls around model-driven tool use, providing concrete engineering material for discussing data access, operational boundaries and evidence. ## From an open question to a documented decision. The work is scoped around a decision or operational need. Each step makes clear what Safematix produces and what your organisation must supply, approve or own. ### Define the question and boundaries Safematix clarifies the decision, systems and stakeholders involved before recommending changes. We agree which evidence is available, what work is authorised and which questions cannot be answered within the engagement. **Deliverables:** - Written scope and exclusions - Input and evidence request - Review and communication plan **Your responsibility:** Provide the decision owner, relevant constraints and existing material through the agreed secure channel. ### Review the current state We examine the selected architecture, controls and operating practices against the agreed questions. Observations are discussed in context, so an absent document is not automatically confused with an absent control—or an unverified claim with working protection. **Deliverables:** - Current-state and risk map - Findings with supporting evidence - Options and decision log **Your responsibility:** Make the relevant people and evidence available, and confirm where our understanding needs correction. ### Agree priorities and develop the work Safematix helps turn the review into a sequence of decisions and actions. We develop only the implementation materials included in the mandate; changes to production systems require the agreed authorisation rather than being implied by a recommendation. **Deliverables:** - Prioritised roadmap - Agreed architecture, control or runbook materials - Owners, dependencies and acceptance criteria **Your responsibility:** Confirm priorities and ownership, allocate resources and authorise any agreed changes. ### Verify and hand over We review the agreed result against its acceptance criteria and perform the selected checks or exercises. The handover records what was verified, what remains open and which decisions belong to your organisation after the engagement. **Deliverables:** - Verification or exercise record - Remaining-risk and open-action register - Handover and next-step plan **Your responsibility:** Provide implemented changes for review, authorise checks and confirm operational ownership and risk decisions. ## A defined mandate with clear commercial terms. Start with a focused review, roadmap, workshop or implementation workstream. Safematix confirms objectives, inputs, deliverables, responsibilities, verification, fees and the start date in writing. A day rate is not a fixed-price promise; existing fixed-price packages remain limited to their stated scope. Flexible engagements: CHF 2’200 per working day. Longer, clearly scoped remote projects: CHF 2’000–2’100. Short-notice OT, red-team, and high-security engagements: CHF 2’400–2’600, subject to scope. All package prices and day rates exclude applicable VAT and pre-approved travel and third-party costs, unless expressly included in the order form. Fixed-price packages apply within their stated scope. Scope, authorization, and start date are confirmed in writing before work begins. Regulatory mapping is technical, not legal advice. Savings and compliance outcomes are not guaranteed. ## Questions before commissioning consulting. ### Do we need consulting or a penetration test? A penetration test examines exploitable weaknesses within an authorised technical scope. Consulting helps answer questions about priorities, architecture, governance or operating responsibilities. The two can complement each other, but one does not automatically include the other. Safematix will distinguish the work and its deliverables in the written scope. ### Can you review our ISMS or help with regulatory requirements? Yes. Safematix can review selected policies, controls and technical evidence, identify gaps and help develop a roadmap. An ISMS review or technical mapping is not a certification, regulatory approval or legal opinion. Your organisation remains responsible for its obligations and for involving the appropriate qualified assessor or legal adviser. ### Will Safematix also implement the recommendations? Implementation support can be included, but it is not assumed. The mandate states whether Safematix provides recommendations, develops materials, works alongside your team or performs authorised changes. It also identifies the client responsibilities and the evidence needed to review a change before it is considered complete. ### How is the engagement priced? Safematix estimates the effort from the agreed questions, systems, available evidence and deliverables. The published day rates provide the commercial starting point; the applicable rate, expected work and fee arrangement are confirmed in writing. Applicable VAT and approved travel or third-party costs follow the stated commercial terms. ### Can the work be remote or in a restricted environment? Remote work is available worldwide, with on-site delivery by arrangement. Before starting, we agree communication methods, access restrictions and evidence handling. Restrictions may affect which checks are possible. Readiness for background checks does not mean that an existing clearance, unrestricted access or a particular location is assumed. ### What should we include in the first enquiry? Describe the decision you need to make, the systems involved at a high level and any important timing or operating constraints. You do not need to send a complete risk register to begin. Please keep credentials, sensitive architecture and incident details out of the initial form; secure sharing can be agreed during scoping. ## Bring the security decision you need to make. Tell Safematix what needs to be decided, which systems are involved and what constrains the work. We can then define a suitable review, workshop or implementation task. Keep sensitive architecture, credentials and incident details out of the first message. [Discuss consulting scope](https://safematix.com/?service=security-consulting#contact)