AI GOVERNANCE · SECURITY · COMPLIANCE

Use AI. Prove you govern it.

From the inventory of your tools to the evidence for the board and the supervisory authority.

0DCyber Sagl is a Swiss consultancy for AI governance, cybersecurity and GRC.

Let's talk Services

Beyond Checklists

0DCyber Sagl is a Swiss cybersecurity and GRC consultancy. Its founder has forty years of experience across the full stack, from writing code to running boards. We work as an external advisor or as fractional C-level security leadership, for organisations that need senior authority without a full-time hire.

Systems don't fail at the controls you see.
They fail at the assumptions no one tested.

Forty years across the full stack, from writing code to running boards, taught one thing: real risk hides in flawed assumptions and in the relationships between systems, not in isolated technical flaws. Checklists catch what was already anticipated. They don't catch what nobody thought to ask.

0DCyber brings offensive insight, defensive capability, and governance into one coherent view. We design controls grounded in how attackers actually operate and in how risk propagates through an organisation, not in checklist theory. The name reflects the arc the work is built on: from the lowest layer of the stack to the boardroom. Right now that means particular depth in two areas: blockchain and crypto-asset risk, and how organisations actually use AI, the two surfaces changing fastest.

Founder: Francesco Pauselli.

The Path

How this practice was built

A point of view formed by having actually built, broken, investigated, governed, and navigated new terrain, in that order.

01

Builder

Built from the ground up in software development: C/C++, assembly, Unix, networking. Working at the lowest layers of the stack taught the core lesson early: systems rarely fail at visible controls, they fail at flawed assumptions.

02

Breaker

Adversarial analysis came next: understanding how systems are actually exploited, not how they're assumed to be secure. A direct grasp of attacker methodology has driven a defensive-by-design approach ever since.

03

Investigator

Digital investigations and forensics work, including consulting for law enforcement, added a third discipline: treating data as evidence that requires integrity and traceability, not just availability.

04

Guardian

All three disciplines consolidated into governance leadership: vCISO for a Tier-1 international bank, group-wide security risk governance in healthcare, and board-level reporting that translates technical risk into business decisions.

05

Navigator

The same rigor extended to the newest attack surface: on-chain forensics for crypto assets and smart contracts, and risk controls for how organisations actually use AI. Same discipline, applied to terrain that didn't exist when this arc started.

Precision Instrument

Services

Three services lead our work today.

AI governance

We help companies and financial institutions see how AI is used in their organisation, and set the rules and controls that let them show it is governed.

  • An assessment of how staff use AI tools: which tools, for what purpose, with which data, on company or personal accounts.
  • An assessment of the data your AI applications process, in and out, including applications open to external users.
  • Usage and development guidelines built on the principles of the EU AI Act and ISO/IEC 42001: authorised tools, permitted and prohibited data, approval of new tools, roles.
  • Staff training built on the results of the assessment.
Discuss this service

Financial and counterparty intelligence

We check counterparties, beneficiaries and transactions before you sign, and protect the reputation of the people and organisations involved.

  • A map of ownership and control chains, and of beneficial owners.
  • Integrity checks on counterparties, partners and investors: sanctions, politically exposed persons, adverse media.
  • Analysis of the financial and on-chain flows tied to a transaction.
  • A report with findings ranked by severity and a summary for the board.
0DCyber Rothstein Capital Management

Delivered together with Rothstein Capital Management.

Discuss this service

NIS2 training for the board

For boards and management teams that must show they have received the cybersecurity training NIS2 requires of those who run the company.

  • What the directive requires of members of management bodies, and where their personal responsibility begins.
  • Case studies on attacks that use the authority of senior management: the urgent instruction that bypasses internal process.
  • The decisions the board takes in a cyber incident and in supplier risk.
  • Half a day for one or two people, or a full day for up to eight in two sessions. Documentation of the training delivered.
Discuss this service

Other expertise

  • Blockchain and crypto-asset forensics

    Wallet and asset checks before a deal closes, and technical support in disputes.

  • Security and compliance assessment

    Your infrastructure measured against ISO 27001 or NIS2, and the gaps between written policy and practice.

  • Fractional CISO

    Senior security leadership, part-time and ongoing, reporting to the board.

  • Smart contract review

    Technical review of contract logic before deployment.

  • Security awareness training

    Practical programmes that change behaviour. Built on experience training over 20,000 employees.

Direct Experience

This isn't theoretical.

In 2026 I was personally targeted by a social-engineering campaign built around a fake job interview: a convincing counterfeit of an AI coding-assistant installer as the delivery vector, aimed at reaching cryptocurrency wallet data. I caught it early, verified exactly what it touched against threat-intel reporting on the same campaign, confirmed no persistence, and closed it out without loss. Human trust, AI tooling, and crypto custody: the same three pressure points are where most organisations are least prepared, because most people assume this only happens to someone else.
Francesco Pauselli, Founder, 0DCyber

Track record

40 Yrs
Roughly 40 years in IT, 25+ in cybersecurity.
vCISO
Fractional or full-time vCISO leadership for a Tier-1 international bank, an ongoing engagement maintained for as long as the mandate requires, not a fixed term.
20k+
Group-wide security risk governance across roughly 50 facilities and 20,000+ employees, spanning multiple countries, from board-level reporting to on-the-ground incident response.
Sectors
Security leadership spanning banking, healthcare, energy, fintech, and telecom (CH, IT, MT).
Forensics
Digital and blockchain forensics, including wallet/asset investigations and consulting work for law enforcement.
Discreet
Confidential personal-brand and reputation-protection for high-profile individuals.
Engagement Model

How we work together

0DCyber works two ways: as an external advisor brought in for a defined engagement, and as fractional or contract C-level security leadership for organisations that need senior authority on an ongoing basis without a full-time hire.

Every engagement starts with a short scoping conversation: what's actually at stake, what the board or counterpart needs to see, and what a realistic outcome looks like, before any scope or commitment is fixed.

Secure Channel

Contact

To start a scoping conversation, send us a message.

You can also write to info@0dcyber.com.