Olivier Busolini

For CISOs

CISO strategy and roadmap

Advice to CISOs on defining a security strategy the board will fund, and on turning it into a roadmap that delivery teams can run. The work covers risk appetite, target operating model, sequencing and the case for funding.

• Secured board and ExCo validation of a five-year, risk-based strategy at a bank in the Middle East: annual operating budget doubled to $20M, team scaled by more than 50% to 85 FTE.
• Earlier, secured board and ExCo funding for a four-year, NIST CSF-aligned programme covering 30 security domains and about 800 deliverables.
• Reduced supervisory audit findings from more than a dozen to a handful within 12 months.

Digital product security

Shift left and shift up

Security built into the product lifecycle of digital banks and digital companies. Shifting left puts requirements, design review and testing at the start of delivery. Shifting up enables the business to take more autonomous information security and privacy risk decisions, so that products reach the market faster within the risk appetite.

• Designed a digital security operating model with business information security officers, digital security leads and security champions embedded in product squads.
• Built AI-driven DevSecOps tooling and a secure CI/CD platform.
• Embedded security by design in the product cycles of a regulated digital asset bank, with an auditable regulatory posture.

AI

AI risk governance and AI security

Advice on rolling out AI risk governance and AI security across a company: who decides, which models are in scope, how risk is rated, and how security teams test and monitor what the business deploys.

• Defined a bank's AI risk management framework in 2024, mapped to CBUAE guidelines and the NIST AI RMF, covering more than 50 AI models.
• Co-created its AI and data governance committee, with the CISO function as strategic co-owner.

Founders

Startup advisory

Strategic advice and mentoring for early-stage companies in cybersecurity, identity and digital trust.

• Strategic advisor to an early-stage identity and digital trust venture in Switzerland, since 2022.
• Strategic advisor to a cybersecurity technology company in the UAE, since 2023.
• Mentor, Tech4Trust and Trust Valley start-up accelerator, Switzerland, 2021 to 2023.
• Jury member, GISEC North Star start-up competition, Dubai, 2025.
• CISO mentor, CESIN, the French CISO association, since 2021.

Boards

Board advisory and membership

I put technical risk in front of a board as a funding decision rather than a briefing. I am seeking Risk, Audit or Technology committee roles in banking, financial services, fintech or digital infrastructure, in Europe, Switzerland or the UAE.

• Functional reporting to the board risk committee of a Middle East bank, with direct access to the CEO.
• Co-created that bank's AI and data governance committee and defined its AI risk management framework, mapped to the NIST AI RMF, covering more than 50 AI models.
• Zero adverse audit findings across 11 consecutive years of internal audit and regulatory review at two banks, spanning FINMA, MAS and HKMA.
• Advisory board member, Trust Valley Association, Geneva, since 2022.

Mentoring

Mentoring

One-to-one mentoring from an executive with more than 35 years of working experience. It is open to junior cybersecurity specialists building a career, and to employees in any function who want a senior executive's view on a decision, a role or a career move. Format and frequency are agreed in a first conversation.

• Mentoring practice since 2021, through CESIN and the Tech4Trust and Trust Valley accelerator.

For CISOs

CISO masterclass programme

Two full days, three to six months apart. The first, 100 Days to Credibility, secures the mandate. The second, Building Your Operating Model, designs the function that uses it and ends with a written twelve-month build sequence.

Each day runs 09:00 to 16:30, in person, for up to thirty participants. Participants keep ten documents across the two days. Day one was piloted in September 2026.

Digital assets

Digital asset risk assessment

For firms and family offices that hold digital assets. An assessment of how the assets are actually run: who can move them, what an approver can verify on the device in front of them, how holdings reconcile to the chain, and what happens on death, incapacity or dispute.

You receive a rated risk register, a 30, 60 and 90-day roadmap, and an immediate attention notice if something cannot wait.

Executives and families

VIP digital life protection

Attacks on prominent people increasingly reach them through their family, their staff and their devices. The assessment treats each person around the principal at their own tier, and starts with the people and accounts that can move money or recover an account on the principal's word.

You receive a report for the principal and one for each person, a 30, 60 and 90-day roadmap, and step-by-step guides the family keeps.