Skip to content

Since 2015

Ten years of closing the same gap

Cloud, then governance, then AI, then the supply chain. Each practice exists because a client hit the problem before the market had named it.

Cloudgap · Company No. 09541018 · Incorporated 2015

In short

Cloudgap is a London-based cyber security and AI governance consultancy, founded in 2015, specialising in managed vCISO, AI governance and supply chain resilience for high-compliance organisations in the UK and EU.

The journey

Each practice started with a client problem, not a market

The dates are the credential. Everything below is checkable against public record and against the standards it references.

  1. 2015

    Founded in London

    Cloudgap starts as a cloud security practice, at the point where mass migration to AWS and Azure was outpacing the security skills to do it safely. The gap the company is named after was a skills gap first.

  2. 2018

    The vCISO pivot

    GDPR lands and mid-size companies discover they need security leadership they cannot hire. Cloudgap launches Managed vCISO: enterprise-grade governance on a retainer, for scale-ups whose customers had started asking enterprise-grade questions.

  3. 2021

    Agile delivery replaces the report

    The waterfall consulting model is retired. Security work moves into sprints aligned to the client's own engineering cycle, which is where the daily-findings and adaptive-scope model comes from.

  4. 2023

    AI governance practice

    A dedicated practice stands up ahead of the EU AI Act, covering shadow AI discovery, model provenance and the accountability trail. ISO/IEC 42001 is published in December of the same year.

  5. 2025

    Supply chain and resilience

    Scope extends past the perimeter to aggregate third-party risk, in response to DORA applying in January and the sustained pressure on critical suppliers. Post-quantum readiness joins the practice for data with a shelf life beyond 2030.

How we work

Four positions we actually hold

  • Embedded, not visiting

    We work inside your channels, your standups and your sprints. The alternative - reviewing from outside and delivering a document - is the model this practice was built to replace.

  • Evidence over assertion

    A control that cannot be evidenced did not happen, as far as an auditor, a regulator or a customer is concerned. We build the record as the work happens rather than reconstructing it afterwards.

  • Proportionate, and argued

    Uniform rigour applied to every system wastes effort on the ones that do not need it and under-protects the ones that do. We argue for the level each thing needs, and write the argument down.

  • We say what we do not know

    Where a figure is not verified, it does not go on a page. That applies to this website as much as to a client report - which is why parts of this site visibly say what is still outstanding.

Leadership

The people who would run your programme

Fractional security leadership is a people business, and an anonymous logo is not a credential. This section stays visibly incomplete until it can be filled properly.

[Client input required · Q7]

Named leadership with real credentials (CISSP, CISM, ISO 27001 Lead Auditor, ISO 42001 Lead Implementer and similar), role, a short biography and a headshot. Renders as a leadership grid with Person schema, which is a direct E-E-A-T signal in this vertical.

Start

Three ways in, depending on how close the deadline is.

Or just email a human: hello@cloudgap.ai

We reply within24 hours