Build security and privacy that people can rely on.

Organisations operate in a changing environment of digital risk, public expectations, regulation, partner dependencies, and limited internal capacity. Whether you are a nonprofit, association, public-interest organisation, public body, education provider, research institution, foundation, membership organisation, or established business, you may be responsible for sensitive information, people’s trust, essential services, and digital systems that need to keep working.

The challenge is rarely only technical. Security and privacy must work across leadership, operations, IT, HR, communications, programmes, procurement, partners, volunteers, contractors, and the people you serve. Policies alone are not enough if they are unclear, impractical, or disconnected from everyday work.

Boxfish Labs helps organisations build practical foundations for security, privacy, compliance, and resilience—with humans at the centre. We combine senior advisory and fractional leadership with privacy support, data-dependency strategy, and engaging learning experiences that help people make safer decisions in real situations.

For many organisations, a cyber incident or privacy failure affects more than commercial performance. It can interrupt essential programmes, expose people to harm, disrupt public services, damage hard-won trust, affect funding, create legal or regulatory exposure, and place additional pressure on already stretched teams.

A practical programme helps your organisation:

• Protect personal, sensitive, confidential, member, beneficiary, employee, volunteer, customer, research, or operational information
• Maintain trust with communities, funders, partners, donors, boards, regulators, and the public
• Strengthen resilience against phishing, ransomware, fraud, unauthorised access, data loss, supplier outages, and operational disruption
• Clarify who is responsible for decisions, risk, security, privacy, incident response, supplier oversight, and communication
• Meet appropriate GDPR, ISO 27001, NIS2-related, DORA-related, procurement, sector, or contractual expectations
• Build safer digital habits across diverse roles, work patterns, language needs, and levels of technical confidence
• Make more informed choices about cloud platforms, collaboration tools, AI, data location, service providers, and digital transformation

The goal is not security for its own sake. It is to protect the organisation’s ability to serve people, deliver its mission, and operate with integrity.

Sensitive information is spread across people, tools, and partners

We help map personal and confidential data, systems, cloud platforms, shared drives, collaboration tools, vendors, access patterns, transfers, and critical dependencies—creating a clearer basis for security and privacy decisions.

Security and privacy responsibilities are unclear

We help establish proportionate governance: leadership accountability, operational ownership, policy roles, escalation routes, risk decisions, supplier responsibilities, incident coordination, and reporting.

You need to meet GDPR and data-protection expectations

We support data-flow mapping, records of processing, privacy notices, DPIAs, contracts, vendor management, data rights, incident response, team coaching, compliance monitoring, and Fractional DPO arrangements where appropriate.

You rely on many external providers and partners

We help identify critical supplier, cloud, SaaS, contractor, and subprocesser dependencies; review risks and contracts; clarify security expectations; and build stronger oversight and resilience planning.

People need practical, inclusive security learning

We design human-centred awareness programmes for varied roles and levels of technical confidence. This can include role-aware training, phishing simulations, security ambassadors, serious games, workshops, cyber escape rooms, digital wellbeing, and accessible follow-up learning.

A security incident would strain your organisation

We help establish clear incident readiness: how people report concerns, who decides what, how information is contained, how services continue, how people are informed, and how the organisation learns afterwards.

01 — Understand your mission-critical information and services

Identify the people, information, systems, services, suppliers, locations, and activities that matter most to your mission, operations, legal responsibilities, and trust relationships.

02 — Assess risk, capability, and obligations

Review current security, privacy, governance, supplier, technology, incident, resilience, and awareness practices. Identify the risks and gaps most likely to affect people, continuity, reputation, funding, or compliance.

03 — Establish clear ownership and essential controls

Define responsibilities, policies, escalation routes, access practices, risk reviews, vendor oversight, privacy routines, incident processes, documentation, and evidence in a form teams can understand and maintain.

04 — Build capability across people and partners

Deliver relevant learning, leadership communication, team guidance, security-champion activity, simulations, and partner expectations so safer practices become part of everyday work.

05 — Review, test, and improve

Use exercises, incident lessons, supplier reviews, leadership reporting, internal checks, staff feedback, and changing organisational needs to improve resilience over time.

A proportionate programme respects your mission, resources, governance structure, workforce, services, and risk. It does not require turning every organisation into a large enterprise security operation.

For many organisations, a practical baseline includes:

• A clear view of important information, systems, users, providers, and operational dependencies
• Named leadership and operational owners for security, privacy, incidents, and supplier decisions
• Sensible access, device, backup, update, information-handling, and account-protection practices
• Working processes for privacy, data rights, supplier review, incident reporting, continuity, and communication
• A small, usable policy and evidence set that matches the way the organisation operates
• Awareness and guidance appropriate for employees, volunteers, partners, and differing levels of digital confidence
• Periodic risk, supplier, access, and recovery reviews that inform leadership decisions
• A staged roadmap for frameworks or requirements that genuinely apply to your work

The key test is whether the programme helps the organisation protect people, continue important work, and respond confidently when something changes or goes wrong.

Mission-aware security support

We understand that trust, continuity, inclusion, duty of care, community relationships, and public credibility can be as important as commercial goals. We help translate those responsibilities into practical security and privacy decisions.

Humans at the centre

Security succeeds when it is understandable, accessible, and workable for the people asked to use it. We apply human-centred and behaviour-focused thinking to policies, processes, technology choices, and learning.

Cross-functional perspective

We connect cybersecurity with privacy, governance, suppliers, operational resilience, digital transformation, AI, and people practices—reducing fragmentation between teams and functions.

Flexible access to senior expertise

Start with a targeted assessment or project, then add Fractional CISO, Fractional DPO, awareness, or ongoing advisory support as your needs and capacity develop.

International and multilingual delivery

Boxfish Labs supports international organisations in English, German, Hungarian, Romanian, Ukrainian, and other languages where possible, with a practical understanding of teams working across markets and cultures.