How We Work
Four services. One engagement model. Never committed beyond one interval.
A viewer of capability lists learns what a firm knows. This page is about something more useful: what it is like to hire us, what we commit to, and how we are held to it. The Nexus of Risk framework treats cyber, physical, and human risk as one consequence chain, governed as one discipline, grounded in COSO ERM and ISO 31000.
Delivered by named practitioners who have carried this risk inside federal agencies, the military, and the Fortune 500, not by a junior bench supervised from a distance.
The four services
The first three are how clients typically meet the firm. The fourth is where relationships go.
Assessment
A structured, evidence-based read of where you stand, in one domain or across all three, ranked by business impact and delivered in language a board can act on.
Strategy
The plan that closes the distance between where the assessment found you and where the consequence you carry says you need to be: sequenced, costed, and owned.
Governance design
Operating structures that keep risk governed after we leave the room: policy, oversight, decision rights, escalation paths, and the evidence trail that proves they work.
Sustained engagement
Named practitioners inside your organization on a renewable interval, carrying the program forward and executing what they find. The principal service, described below.
The sustained engagement model
The structure answers the three questions every advisory buyer has: who exactly is doing the work, what are they committed to, and how do I hold them to it.
The interval spine.
You are never committed beyond the interval you are in.
Renewable six-month intervals
Every engagement runs in a defined interval with stated objectives and deliverables. You are never committed beyond the interval you are in.
A gate every interval
In month five, a formal gate review: the work is measured against the objectives, and you renew, rescope, scale, or conclude. The gate is ours to pass, not yours to avoid.
Named practitioners
An Engagement Principal directs delivery. A Principal Advisor serves as Executive Sponsor with standing accountability for the engagement. You know who is on your account, by name.
Execution included
Findings do not become your backlog. The engagement pairs leadership with hands-on delivery, so what we find gets closed, not handed back to your team as homework.
Stepped allocation
As the program matures, allocation steps down by design. A well-governed program should need less of us over time, and the commercial structure says so out loud.
Knowledge transfer
A stated objective of every interval, not a courtesy. Your team should be more capable at the gate than it was at the kickoff, and the gate review measures that too.
Accountable executives behind a vendor's motion
Two engagements place a named senior executive inside a technology vendor's go-to-market motion and hold a defined outcome. One carries the enterprise motion. The other carries the government motion. They are sold separately and can run together.
Fractional Field CxO
For technology vendors scaling into the enterprise, Apogee places a seasoned Field executive, a former CISO, CTO, or CIO, into an accountability position: a named executive who holds a defined outcome for the client's enterprise motion, backed by an Apogee team delivering the governance, compliance, and build work behind it. The Field CxO speaks executive-to-executive as evangelist, technical authority, and peer to the buyer's C-suite; the team behind the seat closes the gaps that stall enterprise deals: attestation readiness, AI governance posture, security documentation, and trust-center substance. Every engagement pairs the Field CxO with a dedicated Risk Program Manager who owns cadence, deliverables, and follow-through.
Market Entry Advisory
For technology vendors selling into government, Apogee places a senior practitioner who has sat on both sides of the government technology transaction inside the vendor's public sector motion, for long enough to build the pipeline and the evidence, and not one day longer. Federal and state relationship cycles run a year or longer, so the first twelve months produce the same leading indicators under a fractional structure as under a full-time hire, at a fraction of the loaded cost and with thirty days of termination exposure rather than a nine to twelve month mis-hire.
What the market entry engagement owns
Coverage model and account strategy
Segment the addressable market, size the opportunity by segment, and produce a ranked account plan naming the mission problem and the buying center for each target.
Senior engagement and pipeline development
Executive-level conversations that connect capability to mission outcome, conversion of existing inbound interest into qualified opportunity, and management of the advisory and partner relationships already in place.
Acquisition pathway and channel
Validate where the vendor can transact today and where a vehicle gap blocks revenue, across schedules, governmentwide acquisition contracts, other transaction authority, cooperative vehicles, and reseller or integrator routes, then qualify the partners that close the gap.
Hire enablement and transition
Define the role the evidence supports, build the scorecard, source a candidate bench, and hand over a documented territory, pipeline, and partner map at close.
Engagements run against a published scorecard of leading and lagging measures, reviewed monthly, with a formal decision gate at month six. Apogee reports against the vendor's own system of record, not a parallel tracker.
What this is not
Standing conditions of every market entry engagement
- Apogee carries no quota, no direct reports, and no signatory authority.
- Apogee performs no activity meeting the Lobbying Disclosure Act definition and holds no registration.
- No contingent fee is accepted on any federal procurement. Performance components are tied to engagement measures, never to award value.
- An organizational conflict of interest screen runs before signature against Apogee's own active pursuits, and a conflicts register is available to the client.
- Where a Founder or practitioner holds a board seat at the client, its treatment during a paid engagement is addressed in the agreement.
- Where Apogee is itself a candidate teaming partner to the vendor, that is disclosed at engagement start in writing.
Market entry advisory operates on a different axis from assessment and attestation, so it does not engage the firm's independence boundary. Apogee advises a vendor on reaching a government buyer; it does not grade the vendor's program and then certify it.
Questions vendors ask
How do technology vendors start selling to government?
Public sector go-to-market advisory starts with a coverage model and a validated acquisition route. For federal market entry, government channel strategy and contract vehicle strategy determine where the vendor can transact today. Apogee's Market Entry Advisory segments the addressable market, produces a ranked account plan naming the mission problem and buying center for each target, and validates routes across schedules, governmentwide acquisition contracts, other transaction authority, cooperative vehicles, and reseller or integrator routes. Federal and state relationship cycles run a year or longer, so the work is built for the first twelve months of the motion.
What is a fractional go-to-market advisor?
A named senior executive placed inside a technology vendor's go-to-market motion who holds a defined outcome without a full-time hire. Apogee offers two: a Fractional Field CxO for the enterprise motion, and Market Entry Advisory for the government motion. They are sold separately and can run together.
Is a go-to-market advisor a lobbyist?
Not at Apogee. Apogee performs no activity meeting the Lobbying Disclosure Act definition and holds no registration. It carries no quota, no direct reports, and no signatory authority. No contingent fee is accepted on any federal procurement; performance components are tied to engagement measures, never to award value. An organizational conflict of interest screen runs before signature against Apogee's own active pursuits, and a conflicts register is available to the client. Board seats are addressed in the agreement, and any teaming candidacy is disclosed in writing at engagement start.
Service by domain
Any of the four services can be scoped to any of the three domains. Domain is the axis you recognize; service is the axis we scope on.
Four services. Three domains.
Domain is the axis you recognize. Service is the axis we scope on.
The cybersecurity services catalog (posture reviews, audits, compliance, AI governance, and the rest) lives under Cyber Risk.
Engagement use cases
Client-agnostic accounts of real engagements, so you know what hiring us looks like in practice.
AI Security Posture & Governance Assessment
Independent assurance over an expanding AI footprint
A global enterprise software provider needed an independent read on the security of its expanding AI stack. Apogee ran a six-week, evidence-led assessment against NIST CSF 2.0, with no system access required, and delivered board-ready findings on architecture, governance, and remediation priorities.
FedRAMP Moderate Equivalency
From gap analysis to audit-ready in 90 days
A cloud-native software company needed FedRAMP Moderate equivalency to sell to DoD contractors. Apogee led the 90-day program: Rev 5 gap analysis, control remediation across the cloud environment, a full body of evidence, and 3PAO readiness through independent assessment.
Three-to-Five-Year Growth Strategy
Turning a world ranking into regional growth
A top-ranked executive education institution held the leading global ranking but not the market perception to match it. Apogee delivered a four-phase, 90-day strategy engagement covering competitive analysis, region-by-region assessment, and an organizational-structure review, culminating in a board-ready growth plan.
"Your adversaries don't separate digital from physical. Neither do we, and most of what surfaces in either began with a person."
The case for one discipline across cyber, physical, and human risk
What we do not do
Focus is a feature. These are boundaries, not apologies.
No implementation sold as standalone capacity
Execution rides inside an engagement with objectives and a gate. We do not rent out hands.
No commercial staffing
We assess, verify, and govern the people function. The one exception is deliberate and narrow: talent placement for public sector entities requiring program management or technology focused roles. Commercial organizations seeking placement should engage a search firm; we will refer you to one.
No operating client infrastructure
We build the program and the people who run it. We do not become your outsourced operations.
No attesting to programs we built
The firm that prepares an organization should not be the firm that grades it. Somebody else does the assessing.
The line we do not cross.
Remediating what we found is not a conflict. Grading what we built is.
Where we work
Headquartered in Silicon Valley with a presence in Washington, D.C. Engagements delivered across three continents.
Take it with you
The engagement model, the leadership service, and the full firm briefing.
Our engagement model, phase by phase, from first assessment to sustained governance.
Download PDFNamed executive leadership inside your organization, on a renewable interval.
Download PDFThe full firm briefing for media, prime contractors, and prospective partners.
Download PDFReady to take a unified view of enterprise risk?
A Risk Briefing is forty-five minutes with a senior practitioner. You leave with a straight answer on the fastest path forward, whether or not it runs through us.
Request a Risk Briefing