Blog - Big Consulting vs. Boutique Cybersecurity Firms | Reveal Risk

When it comes to unfamiliar or complex challenges, partnering with a consulting firm can be a quick and effective solution.  Bringing in a consulting team can also lead to headaches, overspending, and disillusionment of what the output will be vs what gets delivered.  It is important to be intentional and thorough when deciding what consulting firm to partner with.  And despite muscle memory, the choice doesn’t have to start with choosing one of the names that quickly come to mind.  The decision essentially comes down to choosing a large organization that has a broad consulting practice, or a boutique firm specialized in the area of need or your industry.   

Large organizations are often seen as experienced, proven, and broad.  Most of the time, these things are true to some degree. As the saying goes, no one gets fired for hiring <insert big consulting name>…(they may just not be happy about it). All too often, however, organizations partner with the big-name consulting firms and then find out they aren’t exactly what they once thought. I have personally experienced client frustrations firsthand during my time at one of these large consultancies early in my career. After my time in big consulting, I came to the following conclusions: 

• Project teams are often not staffed at the day-to-day execution level according to their skill set. Junior team members, often very recent college graduates, will likely conduct the majority of the day-to-day execution of the project.  
• Deliverables are often generic and centered around the addition of a tool into the environment. 
• There is a significant amount of resource waste with numerous layers of leadership with each layer looking for their required percentage of the billable hours. 
• Projects are greatly overpriced, and teams are almost always overstaffed with individuals who may not be needed. In addition, off-shore resources are often used to cut costs and increase project margins. 
• Senior leaders are often focused on generating business and smaller clients are often overlooked for the large multi-million-dollar projects. 
• Nothing moves as fast as it should due to bureaucracy within the organization. 

As I grew in my career, I became frustrated with the above-mentioned challenges I faced.  I wanted to help clients solve their cybersecurity problems, but I no longer agreed with the idea that “big names are better”.  During my time at the Indiana University Kelley School of Business, I was surrounded by big-name consultancies. I was blind to the world of boutique consulting and thought it was only for “small specific needs”.  Through my frustrations, I did more research into the idea of boutique consulting and ultimately took the job at Reveal Risk. In my boutique consulting experience, I found the answer to many of the pain points I concluded above. Boutique consulting offers: 

• A tailored approach to solving client needs. No one project is exactly like another, and no two clients are exactly the same. 
• Clients are supported by a right-sized project team and scope.  Keeping teams lean, leads to a reduced cost and less bureaucracy on projects. There is flexibility to work with the client on budget, timeline, and scope leads to solving the exact needs of the client instead of pushing an over-inflated standard approach. 
• Team members that have broad experience while also maintaining specific skill sets. Even the more “junior” team members have vast and diverse backgrounds. 
• Leadership consists of former practitioners (not career consultants) that I find myself learning and growing more from. They are more valuable in helping me and even being part of the day-to-day. 

When choosing a consulting firm for a project, organizations should consider the type of firm.  Big firms are great for tool implementations and projects requiring a large number of resources.  Boutique firms offer a tailored solution that is focused on growing the maturity of the client organization.  Ultimately, in my humble opinion, most projects are equally if not better served by a boutique firm. 

At Reveal Risk, we evaluate, design, and deliver strong processes and results in cyber, privacy, and risk that work efficiently, are fit-for-purpose, and are sustained. If you want assistance building your company’s cyber security strategy, governance, and plan towards desired state maturity, please don’t hesitate to contact us at info@revealrisk.com.  

317.759.4453