When an organisation needs security or resilience advice, the choice often comes down to two kinds of provider: a large, broad consulting firm, or a small firm that does only this work. Both can do a good job. They work in very different ways, and the difference matters most in work that depends on judgement, discretion and trust. This article sets out how to choose, and the questions worth asking either kind of firm.
Key takeaways
- A specialist firm does one kind of work, so its senior people do that work every week.
- In a small firm, the person named in the proposal is usually the person who does the job.
- Fewer divisions and fewer clients mean fewer conflicts of interest to manage.
- A large firm can be the right choice for very large programs that span many disciplines or countries.
- Whoever you choose, ask who will do the work, how conflicts are handled and what you will be left with at the end.
What is the difference between a specialist firm and a large consulting firm?
A large consulting firm offers many services, such as audit, tax, strategy, technology and risk, through separate divisions and hundreds or thousands of staff. Security is one practice among many. A specialist firm is small and focused. Security, risk and resilience are all it does, and the owners are usually the people doing the work.
Neither model is good or bad in itself. The useful question is which one suits the job in front of you.
Who will actually do the work?
This is the question that matters most, and the one that is asked least. In a large firm, a senior partner often leads the proposal and the presentation. Once the contract is signed, much of the day-to-day work can pass to more junior staff, with the senior person reviewing it. That is how the model works: it relies on a wide base of junior people.
Security and resilience work depends on experience. Judging whether a threat is credible, whether a control will hold, or whether a crisis plan would work on the day takes someone who has done the job and carried the responsibility. In a specialist firm, that person is the one on site, in the workshop and writing the report.
At Agilient, every consultant has at least 20 years of experience, typically as a security manager in a large organisation. The person named in the proposal is the person who does the work.
How do conflicts of interest arise in large firms?
A firm that advises many clients across many divisions has to keep those interests apart. One division may advise a regulator while another advises the organisations it regulates. One team may review work that another team sold. Large firms manage this with internal barriers and policies. The bigger and more complex the firm, the harder those barriers are to police.
This is on the public record. In June 2024 a Senate committee tabled the final report of its inquiry into the management and assurance of integrity by consulting services. It made 12 recommendations aimed at greater transparency and accountability in how government uses consultants, and at how large consulting partnerships are governed. The Australian Government responded in December 2025. The Australian Public Service is also bringing more of its core work back in-house.
None of this means that the people in large firms are not capable. Many are excellent. The point is about structure. A small firm with one line of business, no products to sell and no audit, tax or technology arm has far fewer conflicts to manage. Agilient gives advice only. It does not sell, install or monitor equipment, and it does not provide guards.
When is a specialist firm the better choice?
- The work depends on judgement. Examples are a security risk assessment, a security audit, a protective security review or a crisis exercise.
- You want senior people throughout. Not only at the first meeting and the final presentation.
- You need a quick answer. A small firm has few layers. You can ring the person doing the work and get a response the same day.
- Independence matters. The report may need to stand up to a board, a regulator or a customer.
- The job is sensitive. Fewer people see your information, and you know each of them by name.
- You want to keep the skills. A good specialist leaves your team able to do more of the work itself next time.
When is a large firm the better choice?
There are jobs where size is what you need. A large firm is often the better fit when:
- the program needs dozens of people at once, for many months
- the work spans several countries or many disciplines, such as legal, tax, technology and change management together
- you need a statutory audit or a formal assurance opinion from an audit firm
- your organisation requires a global brand for a particular decision.
A good specialist firm will say so. If a job is too large for Agilient, or better suited to someone else, we will tell you.
What should you ask any consultant before you sign?
- Who will do the work? Ask for names and experience, and have them written into the contract.
- How much of their time will I get? Ask what share of the hours the senior people will work.
- Have you done this exact kind of work before? Ask for similar examples and what was learned.
- What else do you sell? Ask whether the firm, or a related company, gains from what it recommends.
- Who else do you act for? Ask how conflicts are found and what happens when one arises.
- How will the project be run? Ask for the plan, the milestones and how often you will hear from them.
- What will we be left with? Ask whether your team will be able to maintain the work without them.
How does Agilient work?
Agilient has advised government and industry on security, risk and resilience since 2012. Our aim is simple: to help clients reach their goals with agile and intelligent solutions. Sometimes that involves us. Sometimes it does not.
- Free tools first. We publish free templates, checklists and self-assessment tools so that organisations can do much of the work themselves.
- A partner to in-house teams. When a team needs a second opinion, extra hands or cover for a key person, we work alongside it for as long as needed and then step back.
- Senior people only. Every consultant has at least 20 years of experience.
- Delivery without fuss. Refined project management, clear milestones and fast responses.
- Independent advice. No products, no installation and no guarding.
Related reading: how to build an in-house security function.
Frequently asked questions
Is a specialist security consultant cheaper than a large consulting firm?
Can a small firm handle government and regulated work?
What if a specialist firm does not have enough people for a large job?
How do I check who will really do the work?
Does Agilient work with organisations that do most of the work themselves?
References
- Senate Finance and Public Administration References Committee, Management and assurance of integrity by consulting services: final report, June 2024.
- Australian Government, response to the Committee’s report, December 2025.
