The problem most executives face
You are being asked to make bets that are too big to get wrong. IT governance, SAP migration, Salesforce, systems integration, ISO certification, AI adoption, security posture, risk management — every one of these decisions compounds for five to ten years after you sign. And the people advising you are usually two things at once: the ones selling the solution, and the ones who will execute it. That is not advice. That is procurement with a PowerPoint.
I sit on the other side of the table.
Three things you get here that you don’t get elsewhere
A peer, not a vendor. Across four decades I spent fifteen years as CIO and CISO of a 24,000-employee group with €900M in revenue. I have been the person signing off on the contract, owning the go-live, explaining the overrun to the board. When your CFO asks me whether a RISE deal makes financial sense, you get an answer from someone who has been on both sides of that conversation — not a sales pitch.
Four decades of pattern recognition. I started on mainframes — COBOL, overnight batch jobs, punched cards for input. I watched transactional systems go online for the first time, saw micro-computing displace the mainframe monopoly, lived through the client-server revolution and then the internet era. After that came Y2K, the Euro, ERP, CRM, COVID continuity, ISO/IEC 27001 and ISO/IEC 20000 certifications, two full ERP renewals, the shift to SAP, a brownfield S/4HANA programme, and the first wave of enterprise AI. Most of the problems your team is about to face, I have already seen break once. That is the value. Not frameworks — memory and experience.
Advice with no second agenda. I do not sell SAP licences, I do not resell Salesforce, I do not partner with implementation firms who pay me for introductions. My only product is judgement. That means I can tell you when the obvious answer is wrong, when a vendor is over-promising, or when the real problem is not technology at all — things a salaried consultant from a big firm has political reasons not to say out loud.
How I work
Small and independent by design. You get me — not a partner you meet once and a team of juniors you live with. My practice operates as LuisFerreira Consulting OÜ, an Estonian private limited company. The Estonian base gives me a clean, fully digital platform to operate across the EU with one entity, one contract, one invoice — regardless of where your business is. Less administrative friction for you; no hiding behind a pyramid of delivery staff for me.
Engagements shaped to your question, not my capacity. A one-hour executive briefing if you need a second opinion before a board decision. A two-week assessment if you are scoping an S/4HANA business case. A fractional CISO or CIO advisory arrangement if you need senior judgement in the room every month. I do not run a timesheet business — I run an advice business.
Confidential by default. What you tell me does not leave the room. I do not publish client names, I do not use logos for marketing, and I will sign whatever NDA your legal team wants signed before we talk seriously.
Information security led at enterprise scale
Before establishing independent practice, I led the certification and ongoing operation of ISO/IEC 27001 and ISO/IEC 20000 at the shared services entity of a major Portuguese group. My conviction — then and now — is that certification is a management instrument, not an audit exercise: the organisation maintained a permanent culture of compliance rather than preparing for renewal audits, validated by continuous third-party monitoring (a SecurityScorecard A rating and a Microsoft Secure Score consistently above 90% across identity, applications, devices and data).
See how each area translates into a specific engagement →
The simplest test
If you are a CEO, CFO, CISO, board member or CIO and you have read this far: the question is not whether you need advice. The question is whether the advice you are getting today is shaped by someone who has your interests — or someone else’s.
Request an executive briefing →
On cybersecurity and AI governance: my approach to client confidentiality, GDPR compliance and EU AI Act alignment is set out in the Cybersecurity & AI Posture Statement, available as a signed PDF for clients conducting supplier due diligence.