Identity and privileged access
Fractional security leadership and programme management for mid-size regulated firms, where identity and access is a regulatory obligation and the demands on it outrun the senior capacity available — because nobody owns it full time, because a programme needs someone to lead it, or both.
01 · The question
Your regulator, your auditor, your largest customer and your board each put it differently. Underneath, it is always this: who and what can reach your systems, and who decided that?
Most firms your size can answer the first half. The second half is where the answer runs out — not because the tooling is wrong, but because nobody in the building owns the decision.
Answering it once is a project. Answering it every quarter is a role.
Your regulator
Who is accountable for access risk, and can they show how it is managed?
Your largest customer
Who approves privileged access, and how often is it reviewed?
Your auditor
Show us that leavers lose access, and that every exception was approved by someone.
Your board
If this goes wrong, whose decision was it?
Four questions. One desk. Whose?
02 · Three ways to work with us
A fixed price or a fixed monthly fee, set out in writing before any work begins — no day rate that drifts and no surprise invoices. If it is not obvious which of these fits, that is what the first conversation is for: we work out with you what your firm actually needs, and tell you if the answer is none of them.
01 · When you do not yet know
Who and what holds access across your estate — workforce, privileged, service accounts and AI agents — who owns it, and how far your controls sit from what your regulator and your enterprise customers expect.
Two deliverables, and neither is a report: a decision your leadership team takes in the room, and a one-page finding on who owns identity in your firm.
How it runs02 · When something has to ship
For work that has a name and a finish line: SSO consolidation, a stalled privileged access rollout, an identity tenant migration, joiner-mover-leaver rebuilt so HR drives identity, standing privilege eliminated, AI-agent access governed.
You name a full-time counterpart. Aevix leads and runs the steering rhythm; the counterpart runs the dailies.
What the engagement is03 · When nobody owns it
Aevix holds the mandate: owns the identity and access position, takes the decisions the roadmap needs inside authority agreed with your board, and represents the firm’s position to regulators, auditors and enterprise customers.
Not an advisor on call. Advice you have to act on yourself is the thing you already have too much of.
What holding the mandate means03 · How fractional works
04 · Who it is for
Fintech, payments, insurtech, wealth and asset management, building societies, and private-equity-backed companies in those sectors — firms that carry a regulator’s expectations on identity and access, and enterprise customers who ask the same questions, without a security function sized to answer them.
DORA, the FCA, PCI DSS, SOC 2, or a customer’s security questionnaire that arrives every quarter and asks who holds privileged access.
Engineers, a platform, a vendor — the hands exist. What is missing is the senior head that directs them and takes the decisions they cannot.
There is not five days a week of decisions to take, so the role goes unfilled, or gets bolted onto someone who already has a job.
05 · Who runs it
You meet the person who has operated what he is leading.
He started and led a global bank’s group privileged-access programme, including the vendor assessment taken to the Group CISO and the internal and external regulatory approval of it across more than sixty legal entities. He returned to it as one of three workstream leads on a sixty-person programme, running thirty people across the migration off the legacy platform and the in-house automation that now onboards the majority of new privileged accounts.
Started the programmeInitiation, definition, the vendor assessment, the first hires.
Legal entitiesRegulatory approval of the programme led across more than sixty of them.
People ledTwo substreams, each with its own PM: migration, and in-house software.
Next step
It costs nothing, and if none of this is the right thing for you, we will say so.
hello@aevixadvisory.com