Trust is a structure. Someone has to build it.

In Rome, the arx was the fortified summit of the Capitoline hill. It held the treasury, the auguries and the last line of defence. When the lower city was taken, the arx was what remained — and as long as it stood, the city had not fallen.

Trust in a company works the same way. It is not a statement on a website or a certificate in a frame. It is a structure: decisions recorded, controls that function, evidence you can produce on demand, and people who know what to do at three in the morning. It is built slowly, and it is defended continuously.

In 2026 the pressure arrives from four directions at once. NIS2 has pulled thousands of mid-size companies into scope and made their directors personally accountable. DORA asks financial entities and their ICT providers to evidence resilience contract by contract. The Cyber Resilience Act turns security into a condition of market access for anything with digital elements. The AI Act sets obligations for organisations that merely use an AI system, not only those that build one.

At the same time, the attack surface has moved. Cloud adoption put critical systems outside the perimeter. Generative AI put company data into tools nobody approved. Supply chains turned every supplier into a possible entry point.

The companies caught in the middle — fifty to two thousand people — rarely have a compliance team. They have an IT manager with a full plate, a CFO watching the budget, and a board that has just discovered it is accountable. The large consulting firms will quote them a programme they cannot afford, staffed by consultants who learned the framework last quarter.

We built Arx Fidei for exactly that gap. One senior partner who stays on the engagement from first call to final readout. Four practices — cybersecurity, compliance, cloud and DevSecOps, AI — held by the same people, because the gaps between practices are where findings and incidents live.

Underneath, a unified control framework. NIS2, DORA, ISO 27001, SOC 2, GDPR and the AI Act ask overlapping questions in different words. We map them once, so a control is implemented once, evidenced once, and reused in every audit that asks for it.

And security built into the delivery pipeline rather than reported on top of it. A finding in a pull request costs an hour. The same finding in an audit report costs a quarter.

Eighty per cent of our catalogue is sold at a fixed price, with the deliverables written down before you commit. Our packs carry names, timelines and price bands, published on this site rather than revealed after a discovery phase.

Our engagement model has six steps and a weekly thirty-minute checkpoint. You always know what has been done, what is next, and whether we are on schedule.

Compliance is not a project that ends. A certificate has to be maintained, a register kept current, an AI system re-reviewed when it changes. So we are built around recurring services — vCISO, Compliance-as-a-Service, Managed DevSecOps — rather than around one-off missions that leave a report behind and nobody to maintain it.

A pack is usually the way in. What follows is a relationship.