From a shared table at Fishburners to a new kind of audit firm.
Paul Wenham was sitting across the table from Rob McAdam at Fishburners in 2019, when AssuranceLab was still a single-person consultancy. Rob was already a seasoned operator, building his second company after founding Pure Hacking and CXO Security. Paul was building a modern audit practice from scratch.
Rob saw the opportunity immediately. Annual recurring revenue, long customer relationships, and a position right at the intersection of cybersecurity and compliance - a space that was only becoming more important as companies used trust and security to unlock revenue growth. The opportunity spoke for itself.
The timing was not quite right for a deal. But what started that day was something more valuable: Rob became an unofficial mentor and advisor to Paul, staying close to the business as it grew.
Over the next few years, AssuranceLab grew from one person to a team of 60, serving more than 1,200 clients across over 30 countries. It became the modern security audit practice that high-growth technology companies reached for first, before it was acquired by Sensiba.
A lot changed during that journey. The practice that set out to make compliance accessible for startups became part of an industry scaling fast around the world. As it grew, the model that once tailored every audit program to the client began to feel the pressure of templated delivery.
Some of the earliest technology Paul built to adapt audits to each company's real operation was devalued in a system optimised for volume. The report still carried the right name, but the substance and alignment that made audits genuinely useful started to slip.
Audits work best when the report matches the company.
When an audit is forced into a template, the company bends to fit the audit. The evidence becomes a parallel world. The report says one thing while the business operates another way. Nobody wins - not the client, not the auditor, and not the customer reading the report.
But when the report truly matches the company, and the auditors meet the client where they are, better outcomes follow. Controls make sense because they map to real workflows. Evidence already exists in the tools people use. The audit becomes confirmation, not archaeology.
That is the idea Rob and Paul kept coming back to. And it is the idea that became Throughline.
Throughline is the firm they talked about building for years. A premium audit services firm that doubles down on the part of the work that matters most: calibrating the audit to the company in front of us.
Paul brings deep expertise from the audit side - Big 4 training, the founder's journey at AssuranceLab, and more than 1,200 audits delivered for high-growth technology companies. Rob brings over twenty years from the adjacent world of cybersecurity consulting: Pure Hacking, CXO Security, and the combination that became Sekuro. Together, they sit across both sides of the compliance conversation.
That combination is what makes Throughline different. We understand the controls, the frameworks, the certifications, and the real-world security pressure that makes them matter. And we are building for the next era of assurance - one that incorporates artificial intelligence, new risks, and new ways of working without losing the human judgment that makes an audit credible.
AI-native companies make that mission more urgent. Their products, engineering practices and compliance programs are changing at once. Throughline is being built to understand those operating models without lowering the assurance bar: AI-managed where technology removes busywork, human-led where judgement and accountability matter, and independently audited throughout.
The firm is founder-built, but the promise is designed to scale: every client has a named senior practitioner who stays accountable from scoping through report issuance.
Two founders, one conversation,
finally in production.
Two decades building offensive security and cyber consulting practices for enterprise and government.
LinkedIn
Former PwC manager, founder of AssuranceLab and former Sensiba partner and Chief Innovation Officer. Now co-founder of Throughline, focused on compliance and assurance for AI-native companies.
LinkedInIndependent assurance for the company you are becoming.
Book a call, send an email, or read more about how we calibrate audits to the company you actually are.