Currently fully booked. New engagements onboard from early 2027.Join the 2027 waitlist
Petr Pospíšil is a relaxed but direct security advisor helping European small and medium companies turn regulation, customer pressure, and scattered technical work into a practical security programme.
Before We Work Together
A good security advisor is not just a badge list or a report factory. You should understand how I think, what I believe good security looks like, and whether my style fits the way your company makes decisions.
Direct advice, practical priorities, and security work that a founder-led SME can actually maintain.
Security analysis, regulatory explainers, and opinionated guidance written for people who make decisions.
Certifications and institutional work matter only if they improve judgement. I use that background to make risk clearer, not to hide behind acronyms.
Cybersecurity Architect & vCISO-style Advisor
How I Work
I prefer documented processes over quick fixes. Quick fixes are workarounds that quietly become problems later. When one is genuinely needed I will do it - then write it down and feed it back into the process. The working pattern is Plan, Do, Check, Act: agree it, run it, measure it, improve it.
Management owns the business risk. My job is to make it visible, reduce it with sensible controls, and help you decide what to accept, transfer, or fix first.
BEST FIT
European small and medium companies up to roughly 250 people. Headcount matters less than the size of the IT footprint supporting the business - facing ISO 27001 readiness, customer due diligence, or NIS2 scope questions.
STARTING POINT
Assessment first, then retainer if you need an ongoing rhythm for implementation and security decisions.
Background
From breaking systems, to defending them, to owning the strategy. Each stage informs how I read risk today.
01
Started as a red teamer, learning exactly how attackers think and exploit weaknesses.
02
Moved to the blue team, proactively hunting the threats I used to emulate.
03
Ran security for a global retail enterprise, focused on threat intelligence and strategy.
04
Independent advisor, combining technical depth with business strategy for SMEs.
How I Work
Independence is the difference between security advice you can trust and a sales conversation in disguise. These rules apply to every engagement, SME or enterprise.
Vendor-neutral
I do not take commissions, referral fees, or revenue share from tool vendors. If I recommend a product, it is because it fits your problem - not because someone is paying for the slot.
Open-source-first for SMEs
For an SME with limited security budget, an open-source tool that runs well for years is usually a better answer than a per-seat licence. Lower cost, no lock-in, and your data stays where you control it.
Commercial when it earns its place
Paid tools are recommended when they materially reduce risk or operational load - for example, where managed support, regulatory features, or scale make the licence cost worth it. Never by default.
Institutional Work
Alongside client work, I cooperate regularly with EU CyberNet and occasionally with UNDP and OSCE on international cybersecurity capacity-building.
EU CyberNet
Expert Member (2023+)
ENISA network member. Attended EU CyberNet Summer Schools in Berlin (2025) and Lisbon (2024).
UNDP
Expert Roster (2023+)
Vetted UN cybersecurity expert - cleared for global deployment on capacity-building programmes.
Certifications
Certifications matter less than judgement, but for some engagements they are the door-opener. Held credentials include:
Beyond the SME engagement
The main engagement is the SME retainer. Outside of that, I have led senior security work inside larger organisations: DevSecOps across the pipeline, building a Cyber Threat Intelligence function, threat hunting programmes, and major incident response.
This depth is relevant once an organisation runs a mature ISMS or operates around CIS IG3. If that describes you, the capabilities page lists where I can help.
Relevant only if your organisation is already operating a mature ISMS. Otherwise the SME retainer is the right place to start.
Latest Intel
2026-06-26
A plain-English starter on the EU AI Act for SMEs. If your small company uses AI tools rather than builds them, here is what actually applies to you - and what you can stop worrying about.
Read post2026-06-25
A founder's guide to what your API pentest actually needs from you. Bring two documents and the test gets cheaper, faster, and more useful. Skip them and you pay for guesswork.
Read post2026-06-12
Information security, cyber security, the CIA triad, CIS Controls and why security people talk like generals - explained for business owners with no IT background.
Read post