Building CM Intel
A private intelligence and protective-security consultancy, and the AI-assisted intelligence production platform that delivers the work.
- Principal
- Connor Maleary — Intelligence Assessor, CT Intelligence Management Unit
- Prepared
- August 2026
- Status
- Draft for review
Bottom line up front
Eight years of counter-terrorism intelligence assessment and a set of formal accreditations almost nobody in the SME consultancy market holds. The opportunity is not “private intelligence” in general — it is a specific, time-limited window created by Martyn’s Law, where thousands of UK venues need terrorism risk assessments written by someone who genuinely understands threat methodology, and the supply of credible assessors is thin.
That is the wedge. Enhanced due diligence, screening and training are the durable lines behind it. The platform is what lets one experienced assessor deliver the throughput of a small team without the quality risk that normally comes with speed.
Alongside current employment
Three fee earners + licensing
Bootstrapped, no investment
Business interest declaration
Connor is a serving CT intelligence assessor. Nothing here can begin — no registration, no marketing, no first conversation — until a secondary business interest has been declared to his unit and approved in writing. Section 05 sets out the boundaries and is the most important part of this document.
The wedge: Martyn's Law
The Terrorism (Protection of Premises) Act 2025 places a statutory duty on qualifying UK premises to assess terrorism risk and act on it. Standard duty at roughly 200–799 maximum occupancy; enhanced duty at 800+, which additionally requires protective measures and a documented assessment for the regulator.
Government signalled an implementation period of at least 24 months, which places the compliance scramble in 2026–2027. Large consultancies will price the enhanced tier at London rates and leave standard-duty premises underserved. This is Connor’s actual professional specialism, in his own region, at a moment of manufactured demand.
Go to market
The failure mode for a solo consultancy is a good service and no pipeline. Five channels, built on relationships that already exist.
- 01
Eastern-region venue outreach
In-scope premises within an hour's drive. Free 30-minute readiness call, one-page gap summary, convert to a paid assessment. Unglamorous and the highest-yield activity available.
- 02
The rugby and community network
Mistley RFC, the county RFU, neighbouring clubs and local schools — warm, in-scope, and they talk to each other. Two at cost for reference value, then hold price.
- 03
Referral partners
Insurance brokers and facilities managers are fielding Martyn's Law questions they cannot answer. Law firms are the route for due diligence and asset work.
- 04
Subcontracting to primes
Registered with mid-tier and large risk consultancies as cleared surge capacity. Low margin, but the cleared CT profile makes him easy to place.
- 05
Authority building
One genuinely useful post a week on readiness and threat methodology, written from practitioner experience. Plus a quarterly free webinar for venue managers.
Qualified conversations per week. Target five. Everything else follows from it.
Financial model
Illustrative, excluding VAT. Year 1 assumes the business runs in parallel with his current role — which is the plan’s most important structural feature, because it means no income risk.
| Year 1 line | Conservative | Target |
|---|---|---|
| Martyn's Law — standard duty | £10,000 | £17,600 |
| Martyn's Law — enhanced duty | £7,500 | £17,000 |
| Enhanced due diligence | £6,600 | £13,000 |
| Training | £3,000 | £6,800 |
| Retainers | £9,000 | £28,000 |
| Cleared subcontract days | £3,600 | £7,500 |
| Costs | (£13,100) | (£13,100) |
| Contribution before drawings | £26,600 | £76,800 |
Compliance and the employment boundary
- Declare the business interest first — through his force or unit’s secondary business interest process, approved in writing.
- Total separation. No CTP or MoD system, database, document, contact, or knowledge-derived-from-access touches CM Intel work. This is a criminal-liability boundary, not a policy preference.
- No trading on access. “Eight years’ experience in counter-terrorism intelligence assessment” is accurate and sellable. “Access to counter-terrorism intelligence” is not, and would end his career.
- Conflict screening on every instruction, with declines recorded.
- DV clearance is sponsor-held. An asset for competing on cleared government work. Never a commercial capability claim.
Alongside that: ICO registration and full UK GDPR compliance, awareness that unlawfully obtaining personal data is a criminal offence under s.170 of the Data Protection Act 2018, and professional indemnity cover of £2–5m before the first paid instruction.
The platform
Deliberately dual-purpose: it is how the work gets delivered, and it is the asset that outlives the consultancy. Generic AI tools produce fluent, unsourced text and put the liability on whoever signs it. The Console enforces the opposite — the drafting agent cannot emit an uncited sentence, a red-team agent attacks each draft, and a human sign-off gate has no disable flag.
| Agent | Constraint |
|---|---|
| Collector | Collects only — forbidden from asserting conclusions |
| Corroborator | Flags single-source claims and circular reporting |
| Analyst | Structures hypotheses; does not write the key judgement |
| Drafter | Every factual sentence carries evidence IDs |
| Red Team | Critical findings block sign-off |
First 90 days
| Weeks | Focus | Output |
|---|---|---|
| 1–2 | Approvals and legal foundation | Business interest declared; company, ICO and insurance in train |
| 2–4 | Identity and public site | Brand agreed, site live, rate card published |
| 3–6 | Platform P0–P2 | Console shell, schema, search and intake on synthetic data |
| 5–8 | Templates and demo | Four report templates; walkthrough ready |
| 6–10 | Pipeline | 100-premises target list; 30 outreach calls; two reference assessments |
| 8–12 | Convert | First paid instruction delivered end-to-end through the Console |
One full-price engagement delivered entirely through the Console, with a client-ready report, a clean audit trail, and a referral obtained. Everything after that is repetition and scale.
Decisions needed
- Has a secondary business interest been raised with his unit, and what was said?
- Leave the CTP role, or run this in parallel indefinitely?
- Daytime availability for site surveys — how much, realistically?
- Any existing warm leads, or starting from zero?
- Appetite for the training line — comfortable in front of a room?
- Trading name and identity direction. “CM Intel” is recommended as the internal platform name only — buyers here respond to names that sound institutional rather than personal.
- Capital available for the £4–6k setup, and any personal income floor.
- Is anyone else joining, or solo for now?
Draft · August 2026 · Commercial in confidence · Fees indicative and unvalidated · Not legal or regulatory advice