Founder · Group CEO · Strategist
Strategy · Cyber Resilience · Governance · M&A · Technology
More than 20 years across technology, operations, cybersecurity and executive leadership — helping organizations strengthen cyber resilience, build governance that works in practice, navigate international growth and prepare for critical transactions.
Strategy matters when it survives contact with operational reality.
Christian de Coster — Founder & Group CEO, Mahoney IT Group
United States · Europe · Asia-PacificStrategy over heroics
My work has rarely been about solving one isolated technical problem. It is about helping an organization define where it needs to go, understand what stands in the way, and build the structure required to get there.
Understands how systems, teams and processes behave under real operational pressure — because I have run them.
Understands customers, capital, risk and execution, and what it costs to build an organization that lasts.
Connects technology, cyber resilience, governance and business objectives into a single operating model.
Brings management, security, operations, finance and technology around the same target state.
“The goal is not to make an organization dependent on one expert. The goal is to build ownership, measurable controls and a team capable of operating them.”
20+ years
A list of employers explains very little. Two things explain most of it: learning to turn information into decisions, and carrying the full risk of building a business across borders.
Staff function S2
Information is worth nothing until it is structured, assessed and turned into a decision someone can act on. Gather, verify, weigh, prioritize, prepare the decision — that discipline is still the core of how I approach risk, governance and strategy, and it is why I insist that evidence be a by-product of the work rather than an exercise before an audit.
Entrepreneurship
Since 2018 I have built and led Mahoney IT Group: customers, capital, risk, teams, technology, partnerships and international operations, with the outcome on my own side of the table. Building an international business is not something everyone does — and having done it changes how you assess someone else's.
2018 — Present · Mahoney IT Group
The ground underneath
Before that, and alongside it, the layers that make the strategy work credible — because I have operated each of them.
The result is fluency across every layer of the conversation:
International operations
International logistics, freight, aviation logistics, customs and export — where a delay is not an inconvenience but a failure.
Nippon Express · Group7 · Fraport Cargo Services · in time Kuriersysteme
Technology
Windows and Microsoft environments, Active Directory, Windows Server, networking, ERP, support, infrastructure and IT projects — hands-on.
WETROPA · LDI Rheinland-Pfalz
Leadership
Technical and commercial operations, process design, personnel, reporting, contract negotiations and organizational development.
cde GmbH
Transformation
Digital strategy, process analysis, workflow transformation, document management, procurement and executive stakeholder work.
City of Schwalbach am Taunus
Speaking & industry presence
Strategy and governance only travel if they can be explained to the people who have to live with them — management, engineers, auditors and customers in the same room. That is also where an approach is tested: an institution decides very quickly whether the reasoning holds.
Speaking engagement
Deutsche Bundesbank
Germany
Germany's central bank — an audience that does not take a claim on trust. That is the standard the rest of this page is written to: a position has to survive the question behind it.
The same session — and elsewhere
Cybersecurity & cyber resilience
I am not a compliance consultant who discovered security through a framework. The security work came first — operations, endpoints, identity, incidents, recovery — and that changes what a control is allowed to be.
Practical domains
Governance philosophy
Governance is not a stack of policies. It is the translation of a requirement into ownership, an operational process, execution, evidence, validation and a decision management can actually make.
The chain
What a control becomes in practice
“Evidence should be the natural output of a working process — not something an organization has to reconstruct before an audit.”
Governance has to survive contact with reality.
Framework experience
Most organizations are not subject to one framework — they are subject to several at once, from different regulators and different customers. The work is to build one operating model that answers all of them, rather than one binder per requirement.
ISMS design, control implementation, evidence and certification readiness.
Type I and Type II readiness, control mapping and evidence preparation.
Cybersecurity governance, risk management and management accountability.
ICT risk, operational resilience and third-party governance.
Security and privacy control alignment where applicable.
Cybersecurity framework and maturity-oriented control design.
Identity, access and segmentation principles applied operationally.
Data protection expectations translated into technical and organizational controls.
Third-party oversight, evidence and accountability across the supply chain.
Continuity and recovery planning that has been tested, not filed.
Incident governance, escalation, reporting obligations and lessons learned.
Oversight, traceability and accountability for AI-supported processes.
The focus is readiness, control design, control implementation, control mapping, evidence, remediation, audit preparation and certification preparation. Independent certification and attestation remain with the relevant certification body or auditor.
Governance in operations
This is what it looks like when a governance requirement stops being a document. One example, end to end.
Example control: Quarterly privileged-access review
Quarterly privileged-access review.
Scheduled automatically, not remembered.
A named person, not a department.
Performed against the live directory.
Recorded with a reason and an expiry date.
Documented by someone accountable.
Produced by the work, not for the audit.
The control reports its own state.
Visible before anyone asks.
Nothing here is reconstructed at year end. The evidence exists because the work happened.
M&A · Due diligence · Integration
Experience supporting both buy-side and sell-side engagements creates a different perspective on cyber risk, technology debt, operational resilience and the integration that follows a transaction.
Buy-side
Sell-side
“On the buy-side, the objective is to understand risk before it becomes acquisition risk. On the sell-side, the objective is to identify and resolve weaknesses before they become valuation arguments.”
Post-merger integration
Due diligence identifies issues. Integration determines whether the transaction delivers value. Technology integration is never only technology — it moves people, suppliers, licenses, contracts, data, controls, processes, teams, security and governance at the same time.
Assess the environment, prioritize risk and agree the target state.
Contain immediate exposure and establish ownership from the first day.
Standardize, remediate and align operations across both organizations.
Report against the target state, close gaps and optimize execution.
A structure that outlasts the transaction and the people who ran it.
What actually has to be integrated
International strategy
Crossing a border multiplies requirements rather than adding them. Security expectations, technology standards, regulation, privacy, supplier dependencies, governance expectations, enterprise customer requirements, data flows and operational responsibility all overlap — and they rarely agree with each other.
United States
Enterprise security expectations, SOC 2, NIST, procurement requirements and sector-specific obligations.
Europe
ISO standards, NIS2, DORA, data protection, supplier governance and cross-border operations.
Asia-Pacific
Cross-border technology operations, suppliers, delivery models and regional complexity.
I have built and operated internationally myself. That is the perspective I bring: practical experience of running an organization across regions — not legal advice for every jurisdiction.
Scale of exposure
Throughout my entrepreneurial career, my teams and I have supported more than 3,000 customer environments across managed IT, MSSP services, cybersecurity, consulting and governance-related initiatives.
“The value of that number is not the number itself. It is the exposure to thousands of different environments, technology stacks, operating models, priorities and levels of maturity.”
Strategy needs execution
Behind the strategic work is an experienced and loyal international team covering cybersecurity, operations, governance, engineering, implementation, remediation and support — supported by Mahoney Control as the measurement and evidence layer.
Christian
Team
Mahoney Control
Strategy → Execution → Evidence
“I can define the target state. My team helps turn it into the operating state.”
Background
Staff functions S2 / S4
Experience in structured operational environments involving situational assessment, planning, logistics and resource coordination.
This background shaped an approach centered on structured information, traceability, evidence, accountability and decision preparation.
Further details are intentionally limited.
Mahoney Control
Mahoney Control is the Cyber Business Intelligence platform built out of this methodology. It exists because the same question kept repeating in every engagement: what is the distance between the state we agreed and the state we are actually in?
Target state
SOLL
SOLL — what was agreed, required or committed.
Operational state
IST
IST — what the environment is actually doing today.
The delta is the work
On artificial intelligence
AI is genuinely useful for analysis, classification, correlation and automation. It shortens the distance between a signal and a decision.
It does not change what governance requires. A control still needs an owner, an execution record and evidence that a human can follow. Where AI contributes to a finding, the finding still has to be traceable and verifiable — otherwise it is an opinion with a confidence score.
Discuss an initiative
For U.S. technology, cybersecurity and governance engagements, services are delivered through Mahoney IT Group. The objective is not another policy binder — it is a resilient operating model that can be measured, evidenced and improved.