BH Consulting, the Irish cybersecurity and data protection consultancy, has launched BH Haven, an ongoing service that gives Irish small and medium-sized enterprises (SMEs) access to its specialist consultants, supported by a proprietary AI tool for analysis, evidence review, regulatory mapping and reporting. Ireland and the UK come first, with the Nordic countries and other EU markets to follow.
The companies it targets answer to GDPR, the NIS2 Directive, the EU AI Act and the EU Cyber Resilience Act, and to customers, partners and cyber insurers with rising expectations. Munster Technological University and Ireland’s National Cyber Security Centre (NCSC) found a critical gap in cyber resilience among Irish SMEs in their SME Cyber Resilience State of the Sector 2025 study, tied to preparedness, resources and access to expertise.
Brian Honan, BH Consulting’s CEO, described who carries that load inside a small company. “We regularly see people within SMEs being given responsibility for cybersecurity, privacy or compliance alongside their normal day job, despite not necessarily having the time or specialist expertise required,” he told Help Net Security. The other common route, he said, is hiring several outside suppliers to cover each area.
Honan said cutting the number of consulting days in the firm’s enterprise model would not solve that. “It would produce a smaller version of something designed for a fundamentally different organisation.”
BH Haven comes in four tiers: Foundation, Standard, Professional and Scale. The services run from risk assessments and technical testing to incident response planning, data protection, AI governance, third-party risk and executive reporting. “SMEs don’t need less rigorous cybersecurity and governance but they do need them delivered in a way that is proportionate to their risks, resources, and business,” Honan said.
A consultant signs off before the client sees it
In a typical engagement, a consultant first learns the client’s business, systems, regulatory environment, customers and risk profile, then gathers evidence such as policies, technical details and earlier assessments. The AI tools sort and analyze that material, flag possible gaps, match evidence to the relevant requirements and lay out a first draft of the findings. Honan said that takes much of the repetitive administration off consultants’ desks.
He drew a line at judgment. “The key point is that the AI does not decide whether an organisation’s risk is acceptable, whether a control is genuinely effective, or what management should do about a material risk,” he said. A consultant reviews the AI-assisted analysis, challenges findings, sets priorities and approves the deliverable. “So there isn’t a single point where AI ‘hands over’ to a human. The consultant remains engaged throughout the process.”
Who answers for a miss
Asked where liability sits if a client is breached through a gap an assessment missed, Honan said: “As with any professional assessment, no consulting firm can credibly guarantee that an organisation will never suffer a breach, never experience an issue or always remain compliant.”
An error in delivering the contracted service falls under the professional obligations and liability terms in the client’s contract, and Honan said using AI internally does not move that responsibility onto the software. The client still runs its own environment and must act on the agreed recommendations. If you are signing up, read the scope section closely, because each assessment covers its agreed scope and the evidence available at the time.
The MSP keeps the firewall
Some managed service providers (MSPs) and managed security service providers (MSSPs) already bundle compliance work into their contracts. BH Haven does not manage a client’s firewall or endpoints, and it does not run a security operations center (SOC), the team that monitors systems for attacks. Its job is governance and assurance: helping management understand its risks and checking independently whether the controls work.
Honan sees those providers primarily as potential partners whose work BH Haven can independently assess. “Ultimately, with BH Haven an SME’s management team has an independent adviser sitting on its side of the table.”
BH Consulting expects to create up to 50 specialist roles over the next three years, counting BH Haven and demand for its other services together.
