How can I tell if a cybersecurity consultancy relies on one star consultant?

Start by tracing each major engagement. Who made the first contact, who scoped the work, who led it, and who wrote the report? Put the answers in a table. If the same name fills every column for the largest clients, that is your answer, whatever the seller says about the team.

Then ask the clients, with permission. Do they know the other consultants? Would they work with someone else? Clients often hire a person, not a firm. Also ask the team what they would do if the star left, and whether they have ever led a client alone. Their answers show whether there is a bench.

Finally, consider what keeps the person. Ask whether they are willing to stay on after closing, in what role, and under what terms. A lawyer can advise on the agreement that holds them to it. Ask how the firm has been recording its methods, templates and lessons, since written practice lets others carry the work. Ask the star as well as the owner, because those two answers may differ. Look at the proposals, since the star’s name on every one says a great deal.

Key takeaways

• Trace each major engagement from first contact to final report.
• Ask clients whether they would work with someone else.
• Find out whether the star will stay and on what terms.
• Check whether methods and templates are written down.