Romain D.

I work mostly in situations where cybersecurity stops being an IT topic and becomes something that influences valuation, legal exposure or regulatory pressure. The conversations usually start when someone says: “We don’t have time; we need to know what this really means.” That is the space I operate in: deals moving fast, disputes where technical facts decide arguments, and boards trying to choose what actually matters rather than everything that looks important.

A large part of my work is with private-equity teams trying to understand what they’re really buying when technology, operational resilience and legal risk collide. A report never changes a deal; interpretation does. A cyber finding rarely kills a transaction, but it often shifts the price, the integration trajectory or the negotiation balance. That’s the part I focus on: turning uncertainty into decisions.

The same applies to litigation and arbitration. Cases involving cyber incidents are rarely clean — timelines conflict, evidence is incomplete and narratives compete. The job is not to sound technical, but to help build a story that a judge or arbitrator can actually follow without drowning in forensic vocabulary.

More recently, my work with boards has grown around NIS2, DORA and other tightening regulatory regimes across energy, infrastructure and financial services. Most organisations don’t have a security problem; they have a prioritisation problem. The question is not “what are the risks?” but “which two will change the financial or regulatory outcome if we ignore them?”

Before consulting, I worked in defence, intelligence and diplomacy, and later at the OECD supporting governments on information-security obligations tied to international tax exchange. Those environments taught me how decisions get made when information is incomplete and time matters. That discipline shapes everything I do now.