Expert data protection and cybersecurity consultancy: Interview with Sean Huggett

What services does Evalian provide?

Evalian is a cybersecurity and data protection service provider. We focus very much on information risk. When I started the business seven years ago, we focused on three areas. We’ve now grown that out to four areas, so data protection, so we provide them an outsourced data protection officer services as well as GDPR and overseas data protection law compliance services.

We can also help our clients with cybersecurity improvements, so helping them with security compliance, dealing with particular challenges that they’re facing, whether it’s supply chain security, whether it’s compliance, or a regulatory obligation like UK NIS 2.

We also provide ISO certification consultancy. So the primary certification we work with is ISO 27001, but we can also help organisations with 22301, which is the international standard for business continuity. And we also work with clients to help them introduce 9001, and then the final practice is penetration testing.

We do offensive security testing for clients to help them understand are their systems secure? Are there vulnerabilities that need to be remediated? And to give them peace of mind that the systems that are standing up, which are internet-facing actually, are resilient to cyber attacks.

Expert compliance and security services

Our consultancy practices cover the following:

• Data protection compliance and outsourced DPO services
• Cybersecurity consultancy
• Penetration testing
• ISO certification consultancy
• AI Governance
• SOC as a Service

We help clients to understand and improve security management and data protection compliance, based on risk management and assurance. We’re not a technology reseller, but we are tech-savvy. We can help clients understand their security and data protection issues and prioritise them for remediation based on their business objectives and obligations.

Our clients

Our clients range from start-ups to multinational organisations. We work across numerous industry sectors: healthcare, financial services, travel, hospitality, marketing, education, construction, property management, technology, software development, Software-as-a-Service (SaaS), local government and legal services, critical infrastructure, and other sectors.

Read our data protection, ISO and cybersecurity case studies

Our team includes lawyers, information assurance practitioners, cybersecurity specialists, penetration testers, compliance specialists, business continuity practitioners, and auditors. As such, we provide a complementary set of skills for clients, and it’s increasingly common that we start working with a client to help with one challenge before being invited to assist with others.

How did Evalian originate? What has your journey been like so far?

My wife and I founded evalian® back in 2018. I originally qualified as a lawyer, working in areas including data protection, before moving into information security later in my career. When we started the business, we aimed to provide real-world, risk-based data protection and security advice for organisations that were being sold services based on fear of massive fines and regulatory penalties.

We were very much a spare room start-up back then, with me working in whatever room of the house was available and winning business based on networking and referrals. Since then, we have grown quickly.

Now, we have a 75-strong team. They specialise in data protection, cybersecurity, penetration testing, and ISO 27001 certification consultancy. Like everyone, we were unsure what impact the pandemic would have on our business, but we continued to grow as organisations recognised that cybersecurity and data protection compliance remained critical.

In 2020, we were certified to ISO 27001 and ISO 9001. In 2021, we were certified Cyber Essentials Plus and became CREST-accredited for penetration testing services and we were one of the first organisations in the UK to be recognised for CREST OVS for web app and mobile app testing.

In 2023, we launched new cybersecurity services focusing on supply chain security assurance, incident response planning and exercising, and cloud security configuration. We are also continuously developing a suite of secure web applications to support the delivery of our consultancy services.

What approach does Evalian take to cybersecurity and data protection?

Clearly, every business and organisation is different and there is no “one-size-fits-all”. Whilst our core skills and experience are transferable between the services, our starting point is to always understand more about the client, including the following:

• Nature of their business
• Clients they work with
• Expectations for security and privacy
• Countries they operate in
• Current and future IT plans
• Business objectives for the current and future years

In working through these aspects, we start to get a feel for their in-house skills and capabilities, their tolerance for risk, and the types of threats they are likely to face. Some clients have apparent objectives at the start of an engagement, whereas others know they need to improve but are unsure what that means.

Understanding the context at the outset helps us scope and deliver an engagement that meets the client’s needs rather than providing a service for the sake of a service. This sounds like something every organisation like ours should do, but we see a lot of cookie-cutter-type services delivered with recommendations that don’t make sense in the context of the client’s business.

The pandemic put the global cybersecurity industry to the test. What do you consider the main challenges that emerged?

Organisations have been talking about digital transformation for years, but the pandemic accelerated it with remote working. This shift has seen new suppliers onboarded quickly, many more SaaS solutions being adopted, and people working in their own homes.

Some of the challenges we saw were entirely understandable given the pace of change, and organisations spent the years immediately after catching up where they could. A security culture is hard to maintain when people are scattered and working in their own homes, so security awareness remains critical.

Supply chain security has become ever more critical. We’ve seen several high-profile supplier security breaches over the last few years, but even at a more basic level, organisations need to verify that their suppliers are not a soft underbelly in their own security posture. With new SaaS tools being adopted quickly, a secure configuration may have been missed, and we are increasingly helping organisations define and implement security standards for SaaS tools.

Incident response planning and exercising also remain critical. As organisations become more digital, they will suffer a breach. Preparing a plan and supporting documentation is important, but exercising the plan through multiple scenarios – from data shared in error to a ransomware attack – helps organisations understand how they can be more resilient to attacks.

What would you consider the biggest mistakes companies make when it comes to handling large amounts of data?

I would consider the following as the biggest mistakes a company might make:

• Not understanding what data it has
• Where that data is
• Who has access to the information
• Why do they have access to the data

This ultimately comes down to accountability. Someone needs to own the different categories of data and be accountable for ensuring it is managed and secured appropriately. They don’t have to be experts on security or compliance. Instead, they need to ensure the specialists in these areas have been consulted, risks and opportunities have been identified, and are being managed.

What threats can arise if compliance audits and other checkups are not conducted regularly?

In line with the previous answer, it can lead to a lack of accountability. Audits for the sake of auditing are never a good thing, but a proportionate assurance program should increase accountability and identify opportunities for security and data protection improvement.

What security frameworks do you see being important for modern businesses?

We consider a Security Operations Centre (SOC) to be an essential component of modern cybersecurity today.

You know, whether you’re a small SaaS startup, a healthcare provider, a local council, or even a global bank, the risks you face are fundamentally the same. The difference is really just scale. In fact, smaller organisations often find themselves in the firing line more often, simply because attackers know their defences might not be as mature.

A SOC serves as the central hub for an organisation’s security operations, where a dedicated team of professionals continuously monitors, detects and responds to cyber threats in real time. It levels the playing field. Suddenly, smaller teams have access to the same quality of threat intelligence, monitoring, and response capabilities that big enterprises have, but without the enterprise price tag.

Operating an in-house SOC has its downsides, though, such as the expense – operating a SOC requires significant investment in personnel and training costs for staff, and expertise – without the right expertise in-house, the SOC team won’t be proficient. 

For many of our clients, it’s about knowing someone’s watching their environment 24/7, helping them respond quickly when something looks off. SOCaaS is no longer a nice-to-have; it’s becoming a core part of how businesses protect themselves and their people.

What’s next for Evalian?

We continue to develop and offer in-house built tools within our managed services, such as SecureIQ – our purpose-built penetration testing tool and vulnerability tracking platform. We also have our supply chain security tool, SupplyIQ, which is a risk management tool we have developed to simplify and improve supplier security.

Our SOC team is onboarding clients effectively, monitoring and responding to threats and incidents, and we are seeing growth in clients requiring support with their AI governance as the landscape evolves and the use of AI within day-to-day operations for clients becomes mainstream.

We are continuing to grow our team with more skilled SMEs across all our areas of expertise. We are really proud of how we’ve grown in the last few years, from a small start-up, to over 75 highly skilled professionals within our cybersecurity, ISO and data protection teams.

Speak to us about your data protection, pen testing, ISO consultancy or cybersecurity requirements

We love to talk about data protection and cybersecurity. Get in touch with our friendly team for a no-obligation chat about your organisation’s needs.