ABOUT THALASSA US

One accountable lead.

Thalassa US is a founder-led cybersecurity and practical AI advisory firm for growing organizations. No bench, no theater — the person you hire is the person who shows up.

02WHY
FOUNDER-LED

Most consulting firms sell you a senior partner and deliver a junior team. The model here is the opposite: one senior advisor, close to the work from the first session to the final handoff.

That only works with scope discipline — taking on work one focused advisor can credibly deliver, and saying no to the rest. You will never find a 24/7 SOC, a rotating bench, or a client roster that doesn’t exist on this site. What you find is what you get.

When an engagement needs more hands than one advisor — a wider assessment, parallel workstreams, specialized tooling — I bring vetted delivery partners and stay accountable for the outcome. You approve the team. You always know who’s doing the work, and why.

What I take on.
What I don’t.

Plain scope, stated up front. If what you need is in the right column, I’ll tell you who does it well — and stay in my lane.

I TAKE ON

Incident readinessTabletop exercises, response runbooks, decision rights settled before the clock starts.
OT & infrastructure hygieneAttack-path reviews and control priorities for operational environments.
Secure AI agent deploymentScope and permissions reviews, data boundary design, agent incident playbooks.
Practical AI automationBounded pilots with documented guardrails your team can own.
CMMC & NIST 800-171 readinessPractitioner-led preparation for defense-adjacent contractors.
AI governanceData safeguards, access controls, policy, NIST AI RMF alignment.
GCC High readinessGuidance for moving into Microsoft’s government cloud — securely and compliantly.

I DON’T

24/7 SOC operationsThat’s a staffing business. I’m an advisory practice.
Full-scope EPC or constructionI assess cyber risk for critical infrastructure — I don’t build power plants.
Nuclear safety engineeringMy nuclear work is cybersecurity risk assessment (NERC CIP, NRC cyber requirements) — a different profession from safety engineering.
Pen-testing as a commodityIf you need a checkbox pentest, there are good shops for that. I do attack-path reviews tied to business impact.
Software resaleRecommendations start from the operating problem — never a product quota.

How an engagement runs.

Smaller and sharper than an enterprise program. The shape stays consistent; the starting point depends on your pressure.

01 / FRAMEStart with the decisionA first conversation defines what you’re deciding, what good looks like, and whether I’m the right fit. If not, I’ll say so.

02 / WORKSenior-led, partner-backedI lead the work directly. Where scope needs specialists, vetted partners join — with your approval, under my accountability.

03 / LEAVETransfer, don’t lingerClear owners, usable artifacts, and a dated sequence of next moves your team can run without me.

Name the risk you can’t afford to leave vague.