We run senior-led security programs for growth-stage companies and regulated industries. Built on discipline, sharpened with our internal AI workbench.

Selected clients and credentials
01 · Thesis


The cybersecurity industry mistakes complexity for sophistication.Every year this industry sells more tools, and every year the breach reports list the same six causes they have listed since 2008: stolen credentials, a misconfigured cloud, identity mistakes, personal accounts, a third party with too much access, and someone getting phished on an ordinary Tuesday. The tools were never the problem. What separates the companies that survive from the companies that get hollowed out is whether somebody actually runs security, week after week, or whether it was bought once, wired in, and forgotten about until the day it mattered.

Founding principle
Cybersecurity is a craft that is meant to be practised, not something you procure.
Karan BhandariKaran Bhandari · Co-founder, Birchlogic
02 · How we work


Old school in discipline
  1. 01

    Identity is the perimeter, not the network.

  2. 02

    Risk appetite is set with the executive team, in financial terms.

  3. 03

    Evidence is built into the workflow that creates it.

  4. 04

    Boards see cyber risk in dollars.

Cutting edge in execution
  1. 01

    Regulatory drift is monitored continuously.

  2. 02

    The bureaucratic 60 percent of consulting runs on AI agents.

  3. 03

    Senior practitioners are multiplied by software, not replaced.

  4. 04

    AI risk integrates into the cyber program, not next to it.

Read the full how-we-work page
03 · Engagement


Tier I

Quick Sprints

Nine engagements we have run enough times to deliver in two to four weeks. Each fixes one specific thing. Senior partner in every meeting. Fixed scope, fixed delivery date.

Most engagements begin with the Security Read.

2 to 4 wks · fixed scope
Tier II

vCISO retainer

The CISO office, on retainer. Three configurations, scaled to the regulator on your back and the board cycle ahead.

Most engagements begin with the Security Read.

Month-to-month · multi-year
Tier III

Fractional Security Office

A complete security office. Dedicated team. We own the program, run the team, report to the board.

Most engagements begin with the Security Read.

12 to 24 months · dedicated
04 · The promise

That is only affordable because a senior partner here is multiplied by an internal AI workbench we built ourselves. The agents carry the volume; the judgment, the accountability and the signature stay with the person whose name is on the engagement. .

05 · Who we work with

Founders, CISOs, and CFOs at growth-stage companies and regulated mid-caps. The kind of operator whose security program has outgrown a single owner but does not yet justify a forty-person CISO office. RBI-regulated fintechs. SEBI mid-caps. MAS-licensed banks, payment institutions, and capital markets firms. They come to us when a specific moment arrives: a US enterprise customer asking for SOC2 with teeth, a regulator’s letter, the board’s first hard question, the week after an incident, the year before an IPO.

Singapore practice →
For founders

Building a startup?

If you are a founder somewhere between bootstrapped and Series B, with an enterprise deal, an audit or an investor’s diligence list somewhere on the horizon, we built something specifically for you, and it is priced for where you are rather than where you are going.


Bring a specific blocker to a thirty-minute call and we will tell you what we would do, in how many weeks. If it is not a fit, we will say so. If it is an emergency, we will start in seven days.

Most engagements begin with the Security Read: three weeks, a fixed fee, and an honest answer at the end about whether you need us any further.

Or send Karan a message on LinkedIn.