Know your security risk before it costs you a deal, an audit, or a customer.
A team of security specialists, led by a CISSP-certified professional, who find and fix the risks that could cost you a deal, an audit, or a customer. As a fixed-scope project, or a monthly retainer.
No sales team. You talk to the people doing the work, not an account manager.
CISSP · 10+ years in security · ISO 27001 · SOC 2 · GDPR · DORA · PCI DSS
When security has no owner, it shows up as a business problem.
Risk that isn't assessed doesn't go away. It waits for the worst possible moment to surface.
- A 200-question security review arrives with your biggest deal, and nobody can answer it with confidence.
- SOC 2 or ISO 27001 becomes contractual, and engineering picks it up between sprints.
- A vendor, an employee mistake, or an AI agent you shipped does something nobody was watching for.
Hiring a full-time security leader is expensive and slow to bring on. Most companies at your stage need the role about a day a week — assessing what's actually risky, and fixing it in order.
Three ways to work with us
Same team, same standards, and the same risk assessment underneath all three. Pick the one that matches your situation.
Talk to a CISO
For one problem you need solved now.
Bring the stalled deal, the questionnaire you can't answer, or the audit deadline in your contract. We assess the actual risk behind it, then hand you a plain-language plan ranked by what matters most. We'll get on the call with your customer if that's what unblocks it.
How consulting works →CISO as a Service
For companies where security has no owner.
A named advisor who knows your company and tracks its risk as it changes: new vendors, new features, new regulation. Policies and evidence your customers ask for, a channel that's always open, questionnaires and vendor reviews handled, so your sales cycle doesn't stall.
What's included →Agent Security Reviews
Now in private beta. Taking early clients.
For teams building their products with AI.
Hand the security decisions to us and keep control of everything else. Your agents ask over MCP whether an action is safe to take and what risk, compliance included, it carries. The agents, the data and the final say stay with you.
How it works for AI teams →All three start the same way: a call, no pitch deck.
Two situations we know well
Beyond general security leadership, these come up often enough to call out on their own.
Crypto asset security
For individuals, family offices, and funds holding meaningful crypto value.
Wallet architecture, key management, and custody decisions reviewed by someone with hands-on experience in this specific area, not a general checklist applied to crypto. We look at how your keys are stored, who can move funds, and what happens if a device, a person, or a custodian fails.
See how it works →Card data & payment security
For companies that store, process, or transmit cardholder data, including crypto exchanges and payment rails bridging fiat and crypto.
A PCI DSS readiness assessment: what's actually in scope, what has to change, and evidence your assessor can act on instead of starting from zero.
See how it works →Why Omalu
Omalu is a new practice, and I'd rather say that than imply otherwise.
It is a team of security specialists led by me, Fedor Bulatovskii, a CISSP-certified security professional with over ten years in the field. We work with growth-stage companies that need credible security leadership before they can afford to hire it full-time.
Every engagement is led by a senior member of the team who stays accountable for it. You get the specialist the work actually needs, and you always know who answered you.
If we're not the right fit for your situation, I'll tell you on the first call.
Book a 30-minute callWhich one do I need?
| Question | Talk to a CISO | CISO as a Service | Agent Security Reviews |
|---|---|---|---|
| Best when | You have one urgent problem | Nobody owns security | You're shipping with AI agents |
| You get | Assessment and plan | An ongoing security function | Reviews on demand, via MCP |
| Speed | Days | Minutes to hours | Seconds |
| Commitment | Per project | Monthly, cancel any time | Monthly |
| Starts with | A free 30-minute call | A free 30-minute call | A free 30-minute call |
| Best when | You have one urgent problem |
|---|---|
| You get | Assessment and plan |
| Speed | Days |
| Commitment | Per project |
| Starts with | A free 30-minute call |
| Best when | Nobody owns security |
|---|---|
| You get | An ongoing security function |
| Speed | Minutes to hours |
| Commitment | Monthly, cancel any time |
| Starts with | A free 30-minute call |
| Best when | You're shipping with AI agents |
|---|---|
| You get | Reviews on demand, via MCP |
| Speed | Seconds |
| Commitment | Monthly |
| Starts with | A free 30-minute call |
All three start the same way: a call, no pitch deck.
How it works
Call
Thirty minutes. What's driving it, and which option fits. If neither does, we'll say so.
Scope
A fixed scope and price in writing before any work starts.
Work
A prioritised plan with owners and dates, and reporting you can hand to a customer, an auditor, or your board.
About
Fedor Bulatovskii, Founder and Principal Security Consultant. CISSP. Over ten years in security, working with growth-stage companies that need credible security leadership before they're ready to hire it full-time.
Omalu is a team of security specialists. Every engagement is led by a senior member of the team who stays accountable for the work, and we bring in the specialist a problem needs rather than handing you off.
We work remotely with clients worldwide.
Questions
How much does it cost?
It depends on the scope: a focused engagement, an ongoing retainer, or agent security reviews. Book a call and we'll quote you directly, in writing, before any work starts.
How fast can you start?
Discovery calls within 48 hours. Project work typically starts within ten business days of scope sign-off, retainers within five.
Who actually answers my questions?
A senior consultant does, for anything that carries risk. Routine questions come back immediately from an assistant trained on our playbooks and your setup, because that is most of the volume and speed matters. Anything unusual, high-risk, or contractually binding goes to a person. You can ask for a human on any question, and you will always be told which you got.
Is what I send private?
Your data is stored in your own jurisdiction and is not transferred out of it. You keep full access and control over it throughout, including the right to export or delete it at any time. Only our team sees it, and access is limited to the people working on your engagement. Routine questions are processed by a model hosted in your region under an agreement that prohibits training on your data. Nothing leaves that region.
Can you get us SOC 2 or ISO 27001 certified?
We get you ready and we run the programme. The certificate itself is issued by an accredited external auditor. Anyone who tells you they can issue it themselves is selling you something else. We'll help you choose one.
We already have a compliance platform, a pen test, or a security tool. Do we need this?
Those tell you what's wrong. This decides what to do about it and owns the outcome. Most clients keep their tools and add the leadership.
What is MCP and do I need it?
MCP is the standard connection between AI assistants and outside tools. You only need it if you're building an AI product of your own. If you're not, ignore that third card.
Do you work with crypto companies or payment companies specifically?
Yes. Crypto asset security, meaning wallet architecture, key management and custody risk, and PCI DSS readiness for anyone handling card data, including crypto payment rails, are both areas we work in directly. More detail →
Let's talk
Tell us what's driving it: a deal, an audit, a deadline, or an AI product you're about to ship. Thirty minutes, no pitch. If Omalu isn't the right fit, we'll tell you that too.
We reply to every enquiry within one business day.