Questions executives ask

Mickom is my principal advisory practice. I help executive leaders work through consequential decisions across technology, AI, cybersecurity, modernization, operating model, investment, and execution.

The work starts with the decision, not a service category. The visible technology problem is not always the actual problem, so the first job is to work out what is connected, where the friction sits, and what should come first.

Fit depends less on headcount or revenue than on the decision. Mickom is most useful when a technology, AI, cybersecurity, operations, investment, or execution decision crosses priorities, functions, providers, or executive ownership, and getting it wrong would matter.

If the decision is narrow and already clearly owned, outside judgment may not be needed. I will say so.

No. I also lead WMI Worldwide, a technology consulting and delivery organization, and I am Founder and Chief Technology Officer of TractionGRC, an AI-enabled cybersecurity and compliance platform. I disclose both relationships at the start of every Executive Assessment.

Assessment fees are set independently of any implementation, technology, or product recommendation. You are under no obligation to engage WMI Worldwide, TractionGRC, or any affiliated organization. You remain free to implement internally, select another provider, or run a competitive process. If an affiliated product or service is among the options considered, that relationship is identified in the recommendation itself.

The Executive Technology Readiness Assessment is the broad view: 24 self-reported questions, about 10 minutes, and a directional read across six areas. It helps show where leadership attention may be warranted.

A domain deep dive takes one area further to help locate what may be creating the friction and what to investigate next. It is still self-reported. More detail, not more assurance.

The professional Technology, AI & Cybersecurity Executive Assessment is a different kind of work. Over four weeks, stakeholder conversations, evidence review, analysis, and professional judgment establish what is actually happening, what is material, and what leadership should prioritize.

The current Executive Technology Readiness Assessment and published domain deep dives are available at no charge.

The professional Executive Assessment and advisory work are separate, paid engagements. Scope and a fixed fee are agreed before any professional engagement begins.

Yes. The conversation option is separate and optional. You can complete the assessment and receive your result without selecting it.

Completing the assessment does not subscribe you to a marketing list or create any obligation to engage Mickom. If you do indicate that you are open to a conversation, Mickom may use the contact information you provided to follow up about your result.

No. Your readiness result is produced by fixed scoring rules. The same answers to the same version of the assessment always produce the same result, and no generative AI model is involved in scoring or in writing your readiness view.

The self-reported tools point to areas and questions worth investigating. They do not make recommendations. In a professional Executive Assessment, findings and recommendations rest on evidence and my professional judgment.

That difference deserves attention. When executives answer the same question differently, it can point to a question about visibility, alignment, ownership, or decision rights.

Where it is useful, more than one executive can take the assessment. Each person should respond independently. Mickom does not average separate responses into a company maturity score, and differences between respondents are not verified findings. They are a starting point for a leadership conversation about what the organization actually knows.

A single number would suggest more precision than a self-reported view can support, and it would hide the differences that matter. An organization can be strong in one area and constrained in another. The connection between them is often the point.

Results are shown domain by domain, with the Flywheel showing where one area may reinforce or constrain another. They are not a peer benchmark or industry ranking.

Take the disagreement seriously. The result reflects the answers given, interpreted through Mickom's maturity bands. It has not been independently verified, and it may miss context that matters to your organization.

Start by asking what evidence would confirm or challenge the result, and whether another leader would answer differently. If the disagreement affects a real decision, that is often a sign that better evidence is needed. The feedback option on the results page is also the best way to tell Mickom where a question or result was unclear.

No. It is an executive advisory engagement. It does not include penetration testing, vulnerability scanning, forensic investigation, or compliance certification or audit-readiness attestation, including ISO 27001, SOC 2, CMMC, HIPAA, or PCI DSS.

If assurance is what leadership needs, the first step is to define the specific audit, testing, attestation, or certification outcome required. That work can be scoped separately.

Exact participation is established during scoping, based on the organization and the depth of assessment required. In general, the engagement needs:

• An executive sponsor
• Focused stakeholder interviews
• Access to relevant existing materials
• Review of priorities and emerging findings
• Participation in the executive debrief

Yes. Mickom can work under mutually agreed confidentiality terms, including a non-disclosure agreement where appropriate. Proposed terms, including a client's standard NDA, are reviewed before they are signed.

Please do not send confidential information through the website form. Describe the situation at a high level, and we can agree on an appropriate channel first.

The assessment collects your name, work email address, organization, role, responses, and the result generated from them. That information is used to produce your readiness view, operate the assessment, and evaluate and improve the assessment.

Under the current retention settings, incomplete assessment sessions are kept for 30 days, completed responses that identify you for 12 months, and personalized reports for 90 days. Aggregated and de-identified statistics may be retained longer when they no longer identify a person or organization.

Assessment responses are not sold to data brokers, and identifying results are not published as proof, a case study, or a testimonial without permission. The Privacy Notice governs how information is handled and explains your choices, including requests for access, correction, or deletion.