Cybersecurity and compliance consulting for startups and SMEs
We help startups and SMEs build the security foundations that win client trust
Choose the situation that best describes your organisation
Each option points to the service that organisations in that position usually start with.
Security, compliance and privacy services for startups and SMEs
Honest about risk
No sugar coating about your posture, your risks, or your budget. Just what's true, and what it will actually take.
Focused on what matters
We help meaningfully where it counts, not by overworking but by maximising the value of every effort.
Meet the consultants behind Cyficient
Specialist services for AI security and compliance
These can be added to any engagement and are delivered by specialists in each area.
Agentic AI Security
As AI agents start making decisions and taking action inside your business, someone needs to ask what they can access and what happens if they get it wrong. We review and govern agentic AI workflows before that becomes an incident.
End-to-End Compliance Implementation
Full implementation support across ISO 27001:2022, SOC 2 Type 2, PCI DSS and more, carried out by certified specialists matched to the standard you actually need, not a single rigid checklist.
Book a free consultation and receive a 2-page risk report
We'll talk through your current setup, then send a short written summary of your most significant risks and what to address first.
About Cyficient and our consultants
Cyficient is a small team of senior practitioners with backgrounds in Big Four consulting, banking, fintech, telecommunications and enterprise IT.
How we choose our consultants
Our team's judgement is the product. Every consultant at Cyficient is selected for demonstrated depth in their field, real-world implementation experience, and certifications that validate that expertise independently.
We work with practitioners who have held hands-on operational roles, not just advisory ones. When we assess your posture, build your programme, or sit at your leadership table, we draw on direct experience of having done that work from the inside.
Our consultants have worked across banking, fintech, telecommunications, e-commerce, and enterprise IT. Their credentials span ISO 27001, SOC 2, professional technology accreditation and GRC, with decades of combined operational experience.
We maintain a deliberate, focused team rather than a large bench of generalists. Accountability matters more to us than scale. You will always know who is on your account before any engagement begins.
Talk to the consultants who will do the work
Cybersecurity, compliance and privacy services
How to get started with Cyficient
Starting a conversation with us is free and there is no obligation. This is what happens from your first message to the start of any work.
Ready to start? Book your free consultation now, or email darsh@cyficient.net.
Book a free consultation →Frequently asked questions
If your question isn't answered below, email darsh@cyficient.net or book a free consultation.
Do we need to get certified to work with you?
No. Certification is optional. We build your security programme around what your business actually needs, whether that's real protection, client credibility, or audit readiness. If a certificate becomes relevant later, we can support that, but it's never the starting point.
A client has sent us a security questionnaire. Can you help?
Yes, and this is one of the most common reasons startups and SMEs contact us. We help you answer each question accurately, identify the gaps the questionnaire exposes, and put the missing policies or controls in place, so your answers hold up if the client asks for evidence.
How much does it cost?
It depends on your size, your starting point and what your clients need. After the free consultation, you receive a proposal with a clear price for each phase, so you can see the full cost before committing. Many smaller businesses start with a Security Posture Review and plan the rest in stages.
We use cloud tools like Google Workspace, Microsoft 365 and AWS. Doesn't the provider handle security for us?
Partly. Cloud providers secure their own infrastructure, but you remain responsible for how you configure and use their services: who has access, how accounts are protected, what data is shared, and how quickly you would notice a problem. Most incidents in smaller businesses happen on the customer's side of that line, which is where we help.
How long does it take to become ISO 27001 or SOC 2 ready?
It depends on how much is already in place, but for most startups and SMEs it takes several months rather than weeks. We give you a realistic timeline in the proposal after the free consultation, and we can prioritise the controls your clients are asking about first.
We're a small team. Is this relevant for us?
Yes, and the earlier the better. Security problems don't wait for companies to grow, and enterprise clients, tenders and serious vendors will ask about your posture regardless of size. Building the foundation early costs far less than fixing a breach or losing a contract later.
Is Human Risk & Culture Management just awareness training?
No. Awareness training is one tool within it. We start by understanding where your people are most exposed and how they work, then combine simulations, role-based training, leadership sessions and regular communication. Success is measured by changes in behaviour, not by how many people completed a module.
Have a question that isn't covered here?
Privacy policy
What we collect when you contact us, why, where it goes, and the rights you have over it. Written to meet Malaysia's Personal Data Protection Act 2010 (as amended in 2024) and the EU General Data Protection Regulation.
01Who we are
Cyficient Consulting is the data controller responsible for personal data collected through cyficient.net. In this policy, "we", "us" and "our" mean Cyficient.
This policy applies to this website and to the free consultation request form. It does not cover client engagements, which are governed by the data protection terms in each engagement agreement.
02What we collect
Information you give us. When you request a consultation, we collect your name, work email, company, country, preferred meeting format, the option you chose to describe your security status, and anything you choose to write in the message field. We also record that you gave consent and when.
Information collected automatically. Our hosting and security provider, Cloudflare, processes your IP address and basic technical information (such as browser type) to deliver the site, block abuse and run the bot check on our form. With your consent, we also use Google Analytics to understand how visitors use the site, such as which pages are viewed, roughly where visitors are and what device they use. It sets cookies (named _ga) only after you click Accept, and Google receives your IP address in shortened form. We do not use advertising cookies, and we never use analytics data to identify you.
Information stored on your device. We store two small items in your browser's local storage: one so the welcome pop-up does not appear on every visit, and one that remembers your cookie choice. Neither contains personal information. You can change your cookie choice at any time using Cookie settings at the bottom of every page.
Please do not include sensitive personal data, such as health or financial details, in the message field. We do not need it to prepare your consultation.
03Why we use it, and on what basis
We will not send you marketing unless you separately ask to receive it. We do not sell personal data, and we do not use it for automated decision-making or profiling.
Providing your details is voluntary. Without your name, email and company, however, we cannot respond to your request.
05International transfers
Some of our service providers process data outside Malaysia and outside the European Economic Area, including in the United States. When data leaves Malaysia, we transfer it only where the destination has a law substantially similar to the PDPA or ensures an equivalent level of protection, or where another safeguard permitted under the Act applies.
For data subject to the GDPR, transfers rely on an adequacy decision (including the EU–US Data Privacy Framework where the provider is certified) or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
06How long we keep it
If your enquiry does not lead to an engagement, we delete your details 12 months after our last contact with you. If you become a client, we keep your information for as long as the engagement agreement and applicable law require. Security logs held by Cloudflare are kept only for short periods under Cloudflare's own retention schedule.
07How we protect it
The site is served only over encrypted connections (HTTPS with HSTS) and uses strict security headers. The form is protected against bots, validated on our server, and sent directly to our inbox without being stored in a third-party form tool. Access to enquiries is limited to the people who need it.
If a personal data breach occurs, we will notify the Personal Data Protection Commissioner and affected individuals as the PDPA requires, and, for data covered by the GDPR, the relevant supervisory authority within 72 hours where required, and affected individuals where the risk to them is high.
08Your rights
Depending on where you are, you have the right to:
To exercise any of these rights, email darsh@cyficient.net with the subject "Personal data request". We may need to verify your identity first. We respond to access requests under the PDPA within 21 days, and to requests under the GDPR within one month. Requests are free unless they are clearly unfounded or excessive.
09Complaints
Please contact us first so we can try to resolve your concern. You also have the right to complain to a regulator. In Malaysia, that is the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi). In the EU or EEA, it is the data protection authority in the country where you live or work, or where the issue occurred.
10Other details
Children. This website and our services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect children's data.
Changes. We will update this page when our practices or the law change, and revise the date at the top. Significant changes will be highlighted on the website.