Independent advice on technology risk, cyber, resilience, governance and emerging issues for boards, executives and senior leadership teams.
Board advisory • vCISOCyber • Technology Risk • AI Assurance
Board-level cyber, technology risk and AI assurance advisory.
Pangolin Advisors helps boards and leadership teams understand material technology risk, strengthen resilience and retain control as systems become more complex and autonomous.
Board Advisory
Cyber Governance
Operational Resilience
Third-Party Risk
Autonomous AI Assurance
What we do
Independent judgement on the technology risks that matter to the business.
We work with boards and leadership teams that need senior, independent advice on cyber, technology risk, resilience and emerging AI without unnecessary complexity.
01
Understand material risk
Identify the cyber, technology, supplier and emerging AI risks capable of materially affecting the organisation.
02
Strengthen resilience
Improve governance, operational resilience and control across critical services, suppliers and technology change.
03
Support better decisions
Translate technical and regulatory complexity into clear choices that boards and leadership teams can act on.
Services
Advisory services designed for practical outcomes.
Engagements range from focused independent reviews to retained board and executive support, with specialist work where regulation or control requires it.
Assess cyber risk, governance and control effectiveness and develop proportionate priorities that make sense to the business.
Cyber health • NIS2 • ISO 27001Examine how critical services depend on technology, people and third parties and whether disruption can be contained and recovered from.
Resilience • DORAIndependent assurance over critical suppliers, technology partners, concentration risk and outsourced dependencies.
Vendor assurance • Supply chainAssess whether autonomous AI systems are operating within clear authority, effective boundaries and meaningful organisational control.
AI governance • Agent assuranceIndependent challenge and oversight of material technology change, remediation and transformation, with a focus on risk, governance and outcomes.
Transformation • Independent oversightWhy Pangolin Advisors
Technology risk is a business problem before it is a technical one.
We focus on clarity, proportionality and outcomes. No scare tactics. No unnecessary complexity. No reports written simply to demonstrate activity.
Independent judgement
Advice starts with the organisation's objectives and material risks, not a predetermined technology or compliance solution.
Board-level clarity
We translate technical and regulatory complexity into decisions boards and executives can understand and act on.
Practical control
The question is not simply whether controls exist, but whether they still change what the organisation or its technology can actually do.
Founder & Principal Advisor
Matthew Apps MSc, CISM
Founder & Principal Advisor
Pangolin Advisors was founded by Matthew Apps, bringing more than 30 years of technology, transformation and cybersecurity experience across complex and regulated organisations.
His background spans executive leadership, financial services, major transformation, cyber governance and operational resilience. That experience is applied independently to help boards and leadership teams make better decisions about material technology risk.
30+ Years Experience
MSc Cybersecurity
CISM Certified
Financial Services
Technology Transformation
Board Advisory
Insights
Practical thinking on technology, control and resilience.
Working papers and articles on emerging technology risk, control and the questions boards and leadership teams increasingly need to answer.
CEO briefing • October 2026
Cybersecurity and AI: A CEO’s Briefing
Regulatory expectations, investment and the gaps that remain.
Cyber and AI budgets are rising. How do you know the money addresses the risks that matter? This UK and EU briefing examines what regulators expect, what organisations are doing, where serious gaps can remain and what to fund, defer or stop.
For an independent assessment of whether your cyber and AI plans address the risks that matter to your business, contact Matt Apps.
Working paper • Version 1.0
Controlling Autonomous AI
How can an organisation retain meaningful control when AI agents are given authority to move money, alter systems, change records and instruct other agents?
The paper develops the ideas of Control Illusion, Control Margin and global admissibility and proposes IABEI — Identity, Authority, Boundaries, Evidence and Intervention — as an assurance structure for autonomous action.
Article
When AI agents stop following rules
What happens when an autonomous system remains technically compliant but moves outside the intent of its controls?
Need independent advice on a material cyber, technology or AI risk?
Start with a conversation about the problem, the decisions that need to be made and the level of assurance you need.