the firm
02 — posture
The Three Lines of Defence model exists because no one organisation can plausibly mark its own homework.
Thirdline takes the third line seriously. We have no delivery business, no vendor ecosystem, and no implementation partnerships to defend. That posture is the entire product.
what we are
what we are not
structural independence
A firm's independence is best read in what it does not have, not what it claims.
We hold no vendor partnerships, no reseller margins, no referral arrangements, no co-marketing agreements, and no certification revenue. We do not maintain a delivery bench, a managed-service tier, or a system-integrator capability. We do not white-label the work of others, and others do not white-label ours.
When we are asked which tool to buy, we have no answer that we are paid to give. When we are asked which implementer to engage, we have no preferred list. When we recommend a path, the only commercial interest behind the recommendation is the engagement itself, and that engagement ends.
absences, by design
leadership
The practice is led by its founding principal, who has spent two decades on the buyer side of large cybersecurity programmes — in financial services, in regulated infrastructure, and in the public sector. The work that informed Thirdline was the work of writing minutes that an auditor later read, and of holding a position when the easier course would have been not to.
Engagements are led by the principal and resourced from a small bench of practitioners selected for the specific domain and the specific posture. We do not staff with juniors against senior rates.
firm details
registered name
Thirdline Consulting Limited
jurisdiction
England & Wales
company number
14882016
registered office
14 Old Burlington Street
London W1S 3BJ