Our Clients

"It’s unusual to get a commendation in an ISO27001 audit but that’s exactly what we got when we were recently successfully assessed for re-certification against the new version of ISO27001. Marmalade Box, was able to manage and deliver the whole transition efficiently and effectively. We will continue to use Marmalade Box’s expertise to maintain our ISMS going forward."

“I’d recommend the SABC™ workshop to security leaders with responsibility for culture change programmes if they’re interested in learning about new thinking on the topic, and about the scientific, academic and real world support for those ideas.”

“Other programs have largely consisted of telling people some facts and hoping that they behave in the way we want. Our lack of understanding the impact of culture on security outcomes is one of the main reasons that we’ve struggled to influence security behaviours. It’s fantastic to see someone tackling the issue of security culture and its impact on behaviour in such a structured and practical way.”

“SABC™ has provided us with a guiding set of principles and a process for delivering demonstrable changes in awareness, behaviour and culture. We’ve integrated these into the design and development of our ISMS and education and awareness programme to ensure that we create the best possible environment for our people to make positive security decisions.”

"I’ve experienced a steady shift in our business culture to incorporate security practices into our day to day activities. Bruce and Marmalade Box tell a compelling story for the Board and our employees and I’d be happy to recommend them."

"I engaged [Marmalade Box] to support me to raise awareness and educate my senior management team representing 8000 clinical and healthcare research professionals around the UK on information security. The result of this engagement was that the NIHR became the first none NHS body to achieve the Information Governance standards associated to healthcare, this enabled a much more agile and open ability to deliver clinical research, some key facts around this include reducing the start-up of a trial from over 200 days to under 20 days and recruiting over 500,000 patients into trials in one year.

"Working with Bruce on this highlighted his vision for the information security landscape in the medium to long term and its relationship to supporting a prosperous and safe digital society."

"With the success of our initial engagement …… regarding awareness, education and engagement and his broad vision of information security and its role within society [Marmalade Box ] was at the top of my list for tackling some of the opportunities and challenges I face in my new role."

"I own and am responsible for the development and execution of the eHealth Strategy across the whole country. Information security plays a critical role in this and has yet to be really considered. I'm looking to build on our success to date by asking Bruce to create and communicate a compelling and informative message, to government wide stakeholders, to bring about the change required."

"As an experienced information security consultant managing ISO 27001 compliance projects including the design and delivery of awareness programmes and having worked with two Big-4 consultancy firms in Senior Manager roles, I can appreciate the importance of effecting and embedding behavioural and culture change into security education and awareness programmes to ensure maximum impact and successful delivery with key stakeholder groups.

"During my time working with Marmalade Box on a client assignment, I was impressed with the Security Awareness, Behaviour & Culture (SABC™) methodology that has been developed to achieve positive security behaviours and a security culture. This stands out as an innovative and well thought through and unique approach to influencing security behaviour and fostering an appropriate culture.

"In my experience, messages delivered from a business perspective rather than a security controls perspective should concentrate on the benefits of good behaviour and less on wielding the ‘compliance stick’. SABC™ provides a move to using more creative, communications and marketing expertise to develop effective programmes rather than the sole use of security subject matter expertise. This is a challenge I have seen in many organisations who use an isolated departmental approach in delivery of education, security and awareness programmes.
SABC™ introduces the use of psychologists and organisational behaviours specialists to help identify ‘what works for whom’ to support awareness programme goals and objectives as well as identifying the triggers that bring about behaviour change. As a result, this focuses on tackling what really matters and what will really benefit organisations as opposed to ‘training everyone in everything’.

"In summary, I can fully recommend SABC™ methodology as an approach to be adopted that delivers positive results and effect culture change. It focuses on providing awareness that fits in with the organisational culture and security strategy and provides a robust platform to help develop good behaviours in the workplace."

"As a business, where innovation is key to our market and success, confidentiality is high upon our agenda. At a period of growth we took the opportunity to examine our control over the confidentiality of our business data and risk to the business cash flow and reputation from information security threats. Marmalade Box delivered unique insight into the management and commercial opportunities & challenges Nanograph Systems Ltd faced during this next stage of our development."

"Bruce was engaging, brought some good external thinking to the table… Liked the ‘if security was a product, would I buy it?’ approach to get discussion going and thinking outside the box."

"Like the majority of companies, we do not have a full time information Security Specialist on our books so it is great to have industry experts like Marmalade Box who we can turn to. They always have a pragmatic approach and help us to understand and explain information security risks to both our colleagues and our clients."

“Brilliant, really great, got me thinking alot and has inspired me greatly.”

"Marmalade Box and Bruce Hallas have supported us to become more aware and better equipped to understand and respond to information security risks."

“I can strongly recommend Marmalade Box to anyone who is looking for ISO 27001 guidance."

"Marmalade Box’s knowledge and understanding of the issues surrounding organisation resilience and, in particular, information security is outstanding. Their approach to raising the issues involved in these topics is innovative and their Founders enthusiasm is infectious."

"Like the majority of companies, we do not have a full time information Security Specialist on our books so it is great to have industry experts like Marmalade Box who we can turn to. They always have a pragmatic approach and help us to understand and explain information security risks to both our colleagues and our clients."

"Recognising the importance of information security to citizens, and public and private sector partners, the County Council engaged Marmalade Box to deliver a review of the current management process for managing information security risk. Marmalade Box delivered the review in a professional manner. They meet our expectations regarding budget and time and demonstrated an excellent understanding of the broad impact of information security across the Council’s activities and more widely within the community it serves.

"I’d recommend Marmalade Box to anyone looking for a review of their current strategic and operational approach to information security."

"The Derbyshire and Nottinghamshire Chamber of Commerce is a leading business support organisation to the Derbyshire and Nottinghamshire business community. Some of this information is sensitive and confidential. Other information is critical to delivering services in a timely manner to our members and partners.

"Marmalade Box has completed an assessment of the Chambers management processes against the industry recognised ISO:IEC 27001 information security standard. In addition, an audit of the existing policies and procedures was conducted.

"The work was thorough and professionally delivered. In addition they showed creativity by combining the two exercises into one, therefore reducing the impact upon our internal resources ability to continue with their day to day responsibilities.

"We would be happy to recommend Marmalade Box to anyone looking for independent advice upon ISO27001, information and ICT security management and business continuity."

"Marmalade Box have an excellent all round ability to deliver information and network security services expected of a security provider. They were able to bring together a first class team to deliver the benefits which we envisaged, plus a few that we hadn’t. However what most impressed me, beyond the quality of their work, was the creativity shown in developing solutions to the changing business needs and environment we operate within.

"Their vision with regards the challenges and opportunities businesses would face including governance, the law and potential sales and marketing opportunities from information security best practice was a good example of this."

"With a career including posts as Information Systems Manager, Auditor and more recently Information Risk Consultant, I was intrigued by the fresh approach developed by Bruce and his team. They took the traditional approach to IT security and broadened it to address management’s concerns such as due diligence, assurance, governance and risk management. Under Bruce’s leadership, the team produced a solution with strong integrity and far more wide-reaching benefits to business.

"I look forward to working with Bruce and the team again in the future."

"Bruce and his team provided project based and ongoing advice in the planning, delivery and review of our approach to information and network security. Their experience in commercial disciplines such as law, governance, HR combined with technical know how enabled us to realise the complete challenge we faced as a UK PLC. From this we were able to ensure that all departments benefited from information security best practice and not just IT/IS function.

"I would recommend the team to anyone looking for independent advice, expertise and the ability to deliver information and network security within an affordable budget."

"Bruce has a clear view on how information & IT security can add value within an organisation based around balancing business risk and impact, to cash flow and profitability, with security threats. This, combined with his ability to quickly grasp stakeholder interests and their relationship with security, enables him to communicate effectively with senior managers and directors. His experience and training outside of IT, especially in law, finance and marketing means that he brings a business perspective to discussions and conducting risk assessments. He understands how security risks could be influenced by factors outside of the IT domain and how IT security incidents can affect the performance and metrics of key business stakeholders.

"Bruce is a problem solver and is likely to throw new light on current IT security management problems. We discussed improving stakeholder engagement, addressing the internal perception of IT Security as a barrier to productive and effective business and developing and maintaining an effective security presence on a limited budget. On a personal level his enthusiasm for security creates a level of interest and enthusiasm for security which inspires others. He is an active team member, willing to answer questions in a pragmatic manner and provides clear practical advice. Bruce is an asset and I look forward to engaging with him again in the future."

"As a marketing agency we regularly need access to customer information. Increasingly our customers are becoming aware about the sensitive nature of this information. CWA decided to take steps to ensure that clients could be confident in CWA’s management of risks to the confidentiality and availability of this data. To do this a decision was made to become ISO27001 certified. Without the internal resources and skills needed it was decided to engage external support. Marmalade Box was originally chosen based upon value for money and independent recommendations.

"After 18 months, of working successfully together, I’d recommend them for their broad management experience including legal, marketing, HR and operations, their creativity which has enabled us to find solutions and their ability to secure the interest and support of employees for better security practices.”

"Our Associate Consultant Programme gives organisations seeking registration to a standard the security of dealing with the UK’s leading certification body as well as a consultant that we believe can help them get to a successful assessment. Membership of the Programme is restricted to those consultants who can demonstrate to us a solid track record and high levels of experience.

"I am happy to welcome Marmalade Box Limited to it."

“The workshop was a definite 5/5. It’s an exciting new approach to behavioural compliance that offers the opportunity to make our interventions significantly more effective and efficient than they are now.”

“I’d recommend the workshop to InfoSec professional with responsibilities for security education and awareness. The workshop will help give them new insights on influencing behaviours and attitudes especially in situations where they’re experiencing diminishing effectiveness with their conventional approaches.”

"Managing a technical team of people with diverse, yet complementary skills and experience, takes a particular talent that can’t be taught. Bruce has that talent. He was able, with a ‘light touch’, to inspire and motivate. His ability to understand the concerns of client business managers and to manage solutions which cost-effectively addressed them was, in my experience, unique."