We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Samurai Digital Security Limited review

Advisory firm

A UK cyber-security consultancy offering virtual-CISO, ISO 27001 and Cyber Essentials advice, alongside penetration testing, managed security monitoring and incident response.

Relevant if you are appointing a first virtual CISO or working towards ISO 27001 or Cyber Essentials

Price Not published
Indemnity cover Not published
How it uses AI Published
Facts last checked

Not published means we did not find it on the firm's own pages.

Samurai Digital Security scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 2/5
Qualifications of the people who do the work 4/5
What it publishes about fees 1/5
Knowledge of your sector 3/5
Independence from what it sells 2/5
Who carries the risk if the advice is wrong 2/5

What Samurai Digital Security offers, and what it publishes

The UK's National Cyber Security Centre assures it for consultancy in risk management, and CREST shows seven years' membership for penetration testing. The firm says its chief executive, Dr David Day, holds CISM, CRISC and CISSP and is an NCSC Certified Cyber Professional. It publishes a Responsible Use of AI Notice covering its own AI use.

Samurai Digital Security does not publish a price. Its virtual-CISO and ISO 27001 pages offer only a free consultation. It does not publish professional-indemnity insurance. Its terms exclude liability for indirect losses and do not promise error-free service. Its AI notice names no AI suppliers or data-hosting locations.

Samurai Digital Security also sells its own AI tools: a virtual-CISO dashboard, an AI Risk Assessment Tool and an AI Scoping Tool. Its named case studies, Flagship Group, an NHS setting and The Preston Associates, quote clients directly. We found no named case of defending a client before a regulator. Trustpilot and Clutch show no reviews.

Strengths

  • NCSC-assured Cyber Security Consultancy in Risk Management is a genuine government assurance scheme for GRC advisory work, confirmed on the firm's NCSC organisation page, not just a penetration-testing listing.
  • CEO Dr David Day holds CISM, CRISC and CISSP, is an NCSC Certified Cyber Professional, and is a Special Officer with the National Crime Agency's National Cybercrime Unit.
  • Publishes a dedicated, named 'Responsible Use of AI Notice' disclosing internal AI practice, human review and data-anonymisation commitments, which is rare public self-disclosure among peers.
  • Publishes named client case studies (Flagship Group, NHS, The Preston Associates) with direct, attributable client quotes rather than anonymised testimonials.
  • Holds multiple independently verifiable accreditations (NCSC, CREST, ISO 9001, Cyber Essentials Plus) confirmed on both the firm's own site and third-party registers (NCSC, CREST marketplace).

Things to check

  • No professional indemnity insurance is disclosed anywhere on the firm's own site, including its dedicated accreditations page.
  • No pricing or fee structure is published for any consultancy service; the firm offers only a free consultation.
  • The firm also sells managed SOC/SIEM, incident response and penetration testing (delivery-layer work) alongside its assurance consultancy, rather than being a pure-play assurance specialist.

Common questions

Does Samurai Digital Security publish its fees?

No. It publishes no prices, fee ranges or rate card for virtual-CISO, ISO 27001 or Cyber Essentials work, only a free consultation.

Does it disclose professional-indemnity insurance?

No. Its site does not mention it, including on the accreditations page. Its terms exclude liability for indirect losses and do not promise error-free service.

Which of its accreditations are confirmed outside its own site?

Two. The UK's National Cyber Security Centre assures it for consultancy in risk management, and CREST lists seven years' membership for penetration testing. It also lists ISO 9001 and Cyber Essentials Plus on its own site.

Does it say how it uses AI itself?

Yes. Its Responsible Use of AI Notice describes human review of AI outputs, multi-factor sign-in for AI tools, data anonymisation and a client opt-out. It names no AI suppliers or hosting locations.

Evidence for each Samurai Digital Security score

Show our working

Notes behind each thing to check

  • No professional indemnity insurance is disclosed anywhere on the firm's own site, including its dedicated accreditations page. (Absent from samuraisecurity.co.uk/about/accreditations-certifications/ and from the firm's own Terms of Service page.)
  • No pricing or fee structure is published for any consultancy service; the firm offers only a free consultation. (Confirmed absent on the firm's own vCISO (risk-compliance/virtual-ciso) and ISO 27001 certification service pages.)
  • The firm also sells managed SOC/SIEM, incident response and penetration testing (delivery-layer work) alongside its assurance consultancy, rather than being a pure-play assurance specialist. (Listed alongside consultancy services on the firm's own site navigation and Risk & Compliance page.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 2/5 Site shows generic incident-response/forensics service pages and one IR-retainer case study (The Preston Associates), but no named regulatory-defence outcome (e.g. an ICO-facing case) was found on the firm's own site or in search.
Qualifications of the people who do the work 4/5 NCSC assures the firm for Cyber Security Consultancy in Risk Management; CEO Dr David Day holds CISM, CRISC and CISSP; staff hold CISSP, CIPP/E and PhD-level cyber quals per the firm's own accreditations page.
What it publishes about fees 1/5 No pricing, fee ranges or rate card are published for vCISO, ISO 27001 or Cyber Essentials consultancy; the site offers only a free consultation, per samuraisecurity.co.uk service pages.
Knowledge of your sector 3/5 Published case studies span housing (Flagship Group), NHS and professional services (The Preston Associates) rather than one deep sector, and the consultancy offer is generalist GRC/vCISO work aligned to NIST and ISO 27001.
Independence from what it sells 2/5 The firm sells its own AI-powered vCISO dashboard, AI Risk Assessment Tool and AI Scoping Tool alongside its advisory work, per its own risk-compliance and tools pages, a proprietary-tool dependency.
Who carries the risk if the advice is wrong 2/5 Published Terms of Service disclaim liability for indirect losses and give no warranty of error-free service, and no professional indemnity insurance is disclosed anywhere on the firm's own site.

Sources for Samurai Digital Security

  • Samurai Digital Security Limited is an active UK private limited company incorporated on 5 December 2016. (Company number 10511079; status Active) (Companies House, checked 19 September 2026)
  • The company's registered nature of business (SIC code) is technical testing and analysis. (SIC 71200 - Technical testing and analysis) (Companies House, checked 19 September 2026)
  • NCSC lists Samurai Digital Security Ltd as a commercial organisation assured under an NCSC assurance scheme for consultancy in risk management. (NCSC-assured: Assured Cyber Security Consultancy services in Risk Management) (ncsc.gov.uk, checked 19 September 2026)
  • CREST's marketplace listing shows the firm has held CREST membership for 7 years, accredited for penetration testing. (7 years CREST membership; penetration testing accreditation) (marketplace.crest.org, checked 19 September 2026)
  • The firm publishes a named 'Responsible Use of AI Notice' describing its own internal AI practices, including human review of AI outputs and data anonymisation. (Self-published Responsible Use of AI Notice) (samuraisecurity.co.uk, checked 19 September 2026)
  • Trustpilot: Trustpilot shows a claimed business profile for samuraisecurity.co.uk with zero reviews ("This company hasn't received any reviews yet"), so there is no review sentiment to report. Clutch also lists a company profile for Samurai Digital Security Limited with zero reviews. (Trustpilot, checked 20 September 2026)

NCSC-assured for "Cyber Security Consultancy services in Risk Management", per the firm's NCSC organisation page (checked 2026-09-19) CREST member for 7 years, accredited for penetration testing, per CREST's marketplace listing (checked 2026-09-19) ISO 9001 and Cyber Essentials Plus, as stated on the firm's own accreditations page, not independently cross-checked against a third-party register in this review

First DPO or AI policySeeking ISO 42001 certificationAfter a breach or ICO contactAfter a ransomware or security incident

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.