Skip to content
Cyber · Programme direction · Worldwide

Nobody gets on the Roll by uploading a CV.

Every name here was examined, referenced and signed for. Brief us, and you get three. Each one arrives with the file that proves it.

Registered
Verified
Called
Underwritten

Four levels. Only the last two reach a client.

The examination

How you get on

Marketplaces check that your documents exist. That is administration, not vetting. Here, someone has to answer for what they know, on record, without preparation.

01

Four questions, drawn at random

From your domain and your level. Each carries a marking grid, so two candidates are actually comparable.

02

Revealed when you press record

Not before. One take, no editing. Preparation is not the thing being measured.

03

48 hours to send the link

You host the video. We never hold a copy. Turnaround is recorded, because reaction time is part of the job.

04

A person signs

The clerk decides on the evidence, and puts a name to the decision. No algorithm admits anyone.

The Roll

ESN access

Names stay sealed until the consultant accepts an introduction. You search the capability, not the person.

TSR·0051 M&A cyber due diligence, private equityGovernance risk and compliance, M&A and deal security, Third party and supply chain Europe/Madrid UNDERWRITTEN
Reg
Ver
Called
Under
TSR·0050 Cloud security posture, multi-cloudCloud security, Vulnerability management America/New_York UNDERWRITTEN
Reg
Ver
Called
Under
TSR·0049 SOC build and detection engineeringSOC and detection, Threat intelligence America/Mexico_City CALLED
Reg
Ver
Called
Under
TSR·0048 Business continuity and operational resilienceGovernance risk and compliance, Resilience and continuity Europe/London UNDERWRITTEN
Reg
Ver
Called
Under
TSR·0047 Data protection and DPO mandatesData protection, Governance risk and compliance Europe/Brussels UNDERWRITTEN
Reg
Ver
Called
Under
TSR·0046 Application security and secure SDLCApplication security, Offensive security Europe/Lisbon CALLED
Reg
Ver
Called
Under

The file

Evidence

Article 21(3) of NIS2 requires you to take into account the vulnerabilities specific to each direct supplier and the quality of their cybersecurity practices. Recital 86 names consulting and audit, and asks for increased diligence at selection.

So the file is not a marketing gesture. It is the paperwork the regulator already expects from you, handed over on day one.

  • 01Identity and legal existenceRegistration, VAT, professional indemnity
  • 02Certifications verified at sourceNot a self-declared list
  • 03Examination on recordQuestions, marking grid, turnaround
  • 04References reachedTwo, called. Notes redacted
  • 05Their own security postureAn expert who cannot answer for their own hygiene is a signal
  • 06Sanctions screeningCleared, dated

What it costs

Published

The margin is written down. Everyone in this market takes one and nobody prints it, which is exactly why you assume it is worse than it is.

Months 0–6

15%

Of what the consultant bills you.

Months 6–12

9%

It goes down on its own. You do not have to ask.

Month 12 onward

Flat licence

A fixed annual fee per active consultant. The percentage stops.

The clock starts at your first introduction, not at each new contract. It is set once and never reset. From day one you know the date you move to a licence.

Two invoices, always. The consultant invoices you directly for their work. We invoice only our own fee. We never touch the day rate, and we never mark it up.

Two ways in

There is no sign-up button

End clients

You don't search. You brief.

Describe the job. The clerk comes back with three, and no more than three. Each one carries the file. If you wanted a search box, you wanted a directory, and there are good ones already.

Ask for access

Consultancies and ESN

You search the Roll yourself.

Anonymised profiles, filtered by domain, level and zone. Ten introductions a day. A subscription, plus a licence per active consultant from day one.

Ask for access

Consultants

Sit the examination.

No fee, ever. You keep your rate, you invoice the client directly, and your name stays sealed until you decide otherwise.

Apply to the Roll