Business consulting and risk management
Clear decisions on the risks that can actually sink you
Business consulting for companies that run on software, data and AI: what to build, buy or stop, where the business is exposed, and a risk plan with owners and dates. From people who have built and run over 50 products and had to live with the consequences of each decision.
The most useful brief is one decision you have to make in the next 90 days, and what happens if you get it wrong.
- How it starts
- A written brief or a file you already have, then a call. Both free.
- Who does the work
- Nikola, plus a named collaborator where the work needs one: named before they start, never a bench.
- What you get
- Artifacts you own and can hand to any team, including one that is not us.
- Payment
- Split across agreed milestones. Nothing hourly by surprise.
How a project works
Where businesses get hurt
The expensive risks are rarely the ones on the agenda
Most companies review sales, costs and hiring every month. The risks that end up costing the most sit in places nobody reviews until something breaks.
- One person holds everything
- One developer, one agency or one founder knows how the product works, where the data lives and how to deploy. If they leave, the business stalls.
- Vendor lock-in nobody priced
- The platform, the builder or the agency owns the code, the domain or the data. Leaving costs far more than anyone planned for.
- AI adopted without rules
- Staff paste customer data into AI tools, agents get access they do not need, and nobody can say which decisions a model made.
- Security and data exposure
- Keys in code, open databases, no backups tested and no plan for a breach. Each is cheap to fix and expensive to discover.
- Build, buy or stop, decided by habit
- Projects continue because they started. Nobody compares the cost of finishing with the value of what it would deliver.
- Unit economics nobody checked
- Cloud, AI and tool costs grow faster than revenue per customer, and the margin disappears quietly.
What we cover
Decisions, a risk register, and a plan someone owns
Everything is written down, prioritized and assigned, so it survives the meeting where it was agreed.
- Strategic decision support: build, buy, partner or stop, with the numbers behind each option
- A business and technology risk register: likelihood, impact, owner and next action for each risk
- Key-person and vendor dependency review, with a plan to reduce each one
- AI adoption policy and governance: what staff may use, with which data, and who approves agents
- Security and data protection review in business terms: what is exposed and what it would cost
- Business continuity: backups, recovery, access and what happens if a key system or person is gone
- Technology due diligence before an investment, acquisition or major contract
- Cost and unit economics review for cloud, AI and software spending
- Operating rhythm: a short monthly risk review your leadership will actually keep doing
How it runs
Find the exposure, rank it, assign it, check it
01
Listen
A working session with the founders or leadership: the business model, the plans for the next year and what keeps you up at night.
02
Look
We review the systems, contracts, vendors, data and the people they depend on. Evidence, not a questionnaire.
03
Rank
Every risk scored by likelihood and impact, in money where possible. Most companies have three that matter and twenty that do not.
04
Decide
For each one that matters: accept, reduce, transfer or avoid, with the cost of each option side by side.
05
Assign
An owner, a date and a next action for every decision, written into a plan your team can follow.
06
Review
A monthly check on progress, new risks and decisions, as a short advisory arrangement if you want one.
What this is not
- Legal, tax or accounting advice. We are not lawyers or accountants and we will tell you when you need one, and what to ask them.
- Investment or financial advice. We help you understand the business and technology side of a decision, not where to put your money.
- A certification audit. If you need ISO 27001 or SOC 2 certification, we can prepare you for it, but the certificate comes from an accredited auditor.
- A report for a drawer. If nobody on your side will own the actions, the money is better spent elsewhere.
Why take this from us
We have carried these risks ourselves
Running over 50 products means we have made the build-or-buy calls, chosen and left vendors, set rules for AI, recovered from outages and shut products down when the numbers said so. We advise from that experience, not from a framework we read about.
- 50+
- products this team has built, run and decided on
- 3
- risks that usually matter, out of the twenty on the list
- $2,500
- a month for 6 hours of ongoing advisory
- 10 hours
- minimum for a one-time review, priced after the call
Questions
Business consulting and risk, in detail
- Who is this for?
- Founders, CEOs and leadership teams of small and mid-sized companies whose business depends on software, data or AI, and who want an outside view from people who build and run that kind of business.
- What does risk management mean in practice here?
- A written list of what could seriously hurt the business, how likely it is, what it would cost, who owns it and what is being done about it. Then a short monthly review so the list stays true. Nothing more complicated than that, and most companies do not have it.
- Can you review a company before we invest in it or buy it?
- Yes. Technology due diligence covers the product, the code, the data, the security posture, the vendors and the people it depends on, with a written view of the risks and what fixing them would cost.
- Do you help us set rules for using AI?
- Yes. We write a practical AI policy: which tools staff may use, which data may never go into them, who may deploy agents and how their work is checked. Where the EU AI Act or similar rules apply, we flag the obligations so your lawyer can confirm them.
- How much does it cost?
- A one-time review is project work at $300–$400 an hour with a 10 hours minimum, quoted in writing after the first call. Ongoing advisory starts at $2,500 a month for 6 hours.
- Will you also fix what you find?
- If you want. We can do the engineering, design and AI work that a decision leads to, or hand a clear plan to your own team or vendor.
Related
Fractional CTO
Senior technical leadership every month.
AI agents
Automating a process once the decision is made.
Product management
Turning the decision into a roadmap.
Free production audit
A first look at the security of your app, in a minute.
Marketing strategy
Positioning and the plan to grow.
Who runs Golux
The person accountable for the advice.
Send it over
Describe the decision or the risk
What the business does, the decision in front of you or the risk you are worried about, and the timeline. Attach anything that helps: a plan, a contract, a vendor proposal.
Everything you send is treated as confidential and is never used as an example or a case study without your written permission.
