A senior cybersecurity advisor for growing companies — under $300M in revenue — that are too complex for generic guidance and too practical for enterprise consulting theater. You get an honest picture of your risk, and a practical plan to reduce it.
Most teams don’t need more findings. They need to know what matters first.
Thalassa turns broad risk into a focused sequence: the decision to make, the owner who makes it, the action that reduces exposure, and the evidence that it worked.
Not a catalog of everything technology can do. Five concentrated offers where security, operations, and practical AI meet.
When the plan has to survive pressure.
Turn policy into a response people can actually run. Decision rights, escalation, evidence handling, communication, and recovery priorities — settled before the clock starts.
When operational reality outruns the diagram.
Find the gaps that matter across identity, access, backups, vendors, and connected operational systems — then fix them in an order your team can actually execute. Includes CMMC and NIST 800-171 readiness for defense-adjacent shops, and cyber risk assessment for energy and nuclear operators — the cyber layer (NERC CIP, NRC cyber requirements), not safety engineering.
When your agents touch real data.
In October 2026, OpenAI notified more than 100 organizations that its AI agents may have accessed their systems. Agents with tools and permissions will find the gaps — yours should be scoped before they do. Least-privilege design, hard data boundaries between agent surfaces and internal systems, and governance aligned to NIST AI RMF. Deploy agents without becoming the headline.
When the workflow deserves more than a demo.
Automate one bounded, valuable workflow without creating a new security problem. Prove the operating value, document the guardrails, and hand over something your team can own — including GCC High readiness guidance where Microsoft’s government cloud is in play.
When AI has to earn its keep.
Most AI projects fail before they start — on the wrong problem. I run the full lifecycle as your advisor: find the use cases worth doing, kill the ones that aren’t, and govern the path from pilot to production. From GenAI assistants through agentic AI to agent-to-agent systems, with governance scaled to the risk at each level. Every use case gets a business case — productivity, quality, cost reduction — before a dollar is spent on build. Pilots that miss their ROI thresholds get killed, not funded.
Every engagement is anchored to a decision, a risk reduction, or an operating change your team can recognize and measure.
THE DIFFERENCENo theater. No mystery team. No software shopping before the operating problem is clear.
The method stays consistent, but the starting question changes. Use the options below to see how the first engagement would be framed.
Begin with a focused readiness review, then pressure-test the plan around one credible scenario.
Thalassa US is a one-person firm on purpose. You’re hiring judgment, not headcount — the person who scopes the work is the person who does it. When an engagement needs more hands than one advisor, I bring vetted delivery partners and stay accountable for the outcome. You’ll always know who’s doing the work, and why.
A focused first conversation defines the decision, right-sizes the engagement, and determines whether Thalassa is the right fit.
Start the conversation