I say when there is nothing to do
A reasonable proportion of scoping conversations end with me saying your position is adequate, or that the thing you were about to buy would not help. That costs a project and keeps the relationship worth having.
About
Independent technical advice, and the work to go with it
Appleby Systems is a small consultancy doing two related things: reducing the technology risk that established businesses carry, and putting AI to practical use inside them. It is led by Paul Appleby.
The practice
Why it is organised this way
Most organisations between about 20 and 500 staff occupy an awkward position. They carry genuine technology risk — client data, financial systems, regulatory obligations, dependence on systems that would stop the business if they stopped. But they are not large enough to employ a security specialist, and the market that serves them is built around support contracts and product resale rather than judgement.
The result is a gap. Support providers do a demanding job well and are measured on availability. Nobody is measured on whether the architecture makes sense, whether a supplier's access is still justified, or whether the AI tool somebody in finance started using last month is a problem. Those questions get asked once something has already gone wrong, or when a client questionnaire forces the issue.
Appleby Systems exists to answer them beforehand. That means senior time on the actual problem, an opinion with the reasoning attached, and — where it is warranted — the implementation to follow.
Why security and AI together
These are usually sold as separate disciplines by separate firms. In practice they collide immediately.
Any AI deployment worth doing needs access to real business information — email, documents, customer records, financial data. The moment that access is proposed, the project becomes a question about identity, permissions, data boundaries and logging. Capable AI projects stall for months at exactly that point, because the people who understand the AI cannot answer the security questions and the people who understand the security were not involved in the design.
Holding both is not a positioning exercise. It is the shortest route to something that actually goes live and stays live.
How engagements work
Engagements start with a conversation, not a proposal. I want to understand what you have, what is worrying you, what has changed recently and what constraints you are working within. That usually takes under an hour and there is no charge for it, because it is also how I decide whether I am the right person for the work.
From there, scope is fixed and priced before anything begins. You will know what is being examined, what you will receive and what it costs. Findings are written to be read by the people who have to make decisions about them, with the technical detail in an appendix for whoever will implement it.
I deliberately keep the number of concurrent engagements low. It limits how fast the practice can grow, and it is the reason the person who assessed your environment is the person who explains it to your board.
Practical details
- Based in
- Dorset, working across the South West and UK-wide
- Typical clients
- 20–500 staff, established, no in-house security team
- Disciplines
- Cyber security, Microsoft 365, AI deployment and governance
- Commercial model
- Fixed-scope pricing, no retainer required
- Independence
- No resale, no vendor commission
- Confidentiality
- Client names never published; NDAs signed as standard
How I work
Six things that shape the work
These are operating constraints rather than values. They have commercial consequences I have accepted deliberately.
No resale, no commission
I take no commission on hardware, software or licensing. It removes an entire category of conflicted advice, and it means "configure what you already own properly" is a recommendation I am free to make.
Written for the reader
Reports go to directors as well as engineers. If a finding cannot be explained in a paragraph a non-technical reader will follow, it is not finished.
The work gets finished
Assessment without remediation moves risk from unknown to documented. That is progress, but not much of it. Engagements are structured so the significant findings are actually fixed.
Your IT provider stays
They know your environment and will support it after I have gone. Working around them produces changes that get quietly reversed.
Few clients at a time
I deliberately keep the number of concurrent engagements low. It constrains growth, and it is the reason the person who assessed your environment is the person who explains it to your board.
Location
Based in Dorset, working across the South West and the UK
Being in Dorset means being on site in Bournemouth, Poole, Dorchester, Southampton, Salisbury, Bristol or Exeter without it becoming an event, and a reasonable amount of work happens across the South West on that basis.
Most of the work, though, does not depend on geography. Microsoft 365 reviews, identity design, AI deployment and governance are delivered remotely as a matter of course, and a good proportion of clients are elsewhere in the UK. Where being in the room genuinely helps — a board briefing, a workshop with an operations team, an incident — I travel.
If you are looking for a cyber security or AI consultancy in Dorset or the South West specifically, I am local. If you are not, that should not count against me.
FAQ
Working with Appleby Systems: common questions
Who would I actually be working with?
Paul Appleby. Appleby Systems is a small, deliberately senior practice — you deal directly with the person doing the work, not an account manager relaying questions to an engineer you never meet. Where a piece of work genuinely needs another pair of hands, I say so and tell you who is involved.
How do you charge?
Assessment and review work is quoted as a fixed price against an agreed scope, so you know the cost before starting. Implementation is quoted per project where the scope is clear, or on a day rate where it genuinely is not. There is no retainer, and advice is not tied to an ongoing contract.
How small is too small?
Below roughly 20 staff there is usually not enough complexity to justify consultancy of this kind, and you would be better served by a good IT provider with security competence. I will tell you if that is my honest read of your situation.
Do you sign NDAs?
Yes, routinely, and I will sign yours rather than insisting on mine. Client names are not published, and every case study on this site is anonymised as a matter of policy rather than by request.
Where are you based and how far do you travel?
Appleby Systems is based in Dorset. On-site work across the South West is straightforward, and I travel further for engagements that justify it. Most assessment and remediation work is delivered remotely, so location rarely determines whether this is a good fit.
What if we already know what we need?
Then say so. Some clients want a specific piece of work delivered — a Conditional Access design, a recovery test, an invoice automation — rather than an assessment. I am happy to start there, though I will mention it if I think the diagnosis is wrong.
Start with a conversation.
No proposal, no slide deck. An hour to understand your situation and establish whether there is work worth doing.