After a data breach or ransomware, and now it has to change structurally.

The moment

During an incident there's no shortage of help: the incident response firm, the insurer, the forensic investigator, sometimes the police. The quiet moment comes afterwards. The report is there, with a list of findings that is honest and long. Management wants to know what changes now. Major customers ask for a statement and for evidence. The IT department is exhausted and wants to get back to normal work, and that's exactly when someone has to implement the measures that prevent it happening again in a year. We're not the fire brigade; we come into the picture once the fire is out and the house has to be refurnished.

What's at stake after an incident

An incident usually exposes what hadn't been right for a while: access that was too broad, backups that weren't tested, logging that existed but nobody looked at, suppliers with too many rights. The findings are known; the work is turning them into measures that still stand in a year, and making that demonstrable for the insurer, the regulator and the customers. On top of that, an organisation often turns out after an incident to fall under the Dutch Cybersecurity Act or DORA, and the reporting and duty-of-care obligations suddenly become very concrete. An experienced interim professional who has been through this before brings calm to that period and makes sure the attention that exists now is turned into something lasting.

What needs to happen now

1. Prioritising the findings. Not everything at once: first what made the incident possible, then what increased the damage, then the rest. The work of an interim security officer or CISO, in the first week.
2. Carrying out hardening. Access, MFA, segmentation, testing backups, setting up logging and detection. A security engineer who does it, alongside your own administrators.
3. Making detection and response permanent. Who sees it next time, and what do they do then. A SOC lead or security officer who sets up the process and rehearses it.
4. Board, customers and insurer. A clear story with evidence: what happened, what has changed, how it's safeguarded. The interim CISO.
5. The team. People who have been through an incident are tired and sometimes afraid of making mistakes. Someone from outside who brings structure without judging helps more there than another report.

Who leads this

After an incident organisations usually look for an interim security officer or CISO who leads the recovery and takes the board along, a security engineer for the hardening, and sometimes a SOC lead who sets up detection and response. Which of those roles it is for you depends on what the investigator found and who's already in place; that's where the intake starts. This is often also the moment an organisation decides to hire someone permanently for security for the first time; that's simply permanent recruitment, and the bridge is interim. We've been doing both for years.

Interim: within two days, and what it costs

Fast doesn't mean sloppy. We start with a proper intake: what happened, what's in the report, who this person needs to bring along, and what may and may not go outside. Then we search a network of interim professionals we have usually known for years, which is how, for an interim assignment, you'll have your first candidate interviewed within two days. If you need someone permanently, it works differently and takes longer. The best permanent candidates are rarely actively looking: they're settled somewhere and only move for the right arguments, from someone who knows them and what drives them. That is exactly our work, and it produces the best match, but not within two days. Interim professionals are entrepreneurs: more commercial, more flexible in both directions, and therefore faster to propose from the network we actively maintain. If we don't have someone who truly fits, we'll say so. You always see the professional's rate and our margin separately, and that margin is never more than €15 per hour on a full-time assignment. You can contract the freelancer directly or through your own broker, in which case we invoice only our margin, or entirely through Gruzzy with a single invoice. Confidentiality is set out before the first name is mentioned. Who is available right now, and in which rate band, is listed anonymously with the available interim professionals.

Freelance, and the Dutch DBA Act

A recovery programme after an incident is an assignment with a clear beginning and end: there's a result, the professional decides how the work gets done, and there's no employer-style line of authority. That is what the Dutch tax authority wants to see now that enforcement on false self-employment has resumed since 2025, so freelance fits well here, with a model agreement. If it turns out during the recovery that the organisation needs a permanent security lead, and it often does, we'll say so. Usually that's a permanent role through recruitment; if you really want someone temporarily on payroll, secondment is possible, although it isn't our core business. We're happy to advise on this before you sign.