What HEFESTIS Ltd does

HEFESTIS Ltd is a Scottish not-for-profit shared service organisation, jointly owned by its member institutions and headquartered in Stirling (SC603511, founded 2018). It delivers four integrated shared services to UK Higher and Further Education and adjacent public-sector bodies: CISO-Share, an integrated cyber risk management offering built around a proprietary six-pillar "Pathway" methodology and supported by named Regional and Managing CISOs; Data Protection & Governance-Share (DPO-Share), which supplies named Data Protection Officers to fulfil statutory GDPR obligations; IRO-Share, which provides Information Rights Officer administrative support for Data Subject Rights and FOI/FOISA requests; and UniDesk, an ITIL-aligned IT service management shared service built on the TOPdesk SaaS platform and tailored for the education sector.

The underlying technology stack is deliberately conventional rather than proprietary: TOPdesk SaaS underpins UniDesk, while CISO-Share and DPO-Share are delivered through human expertise augmented by codified assessment tools, templates, and a community collaboration layer hosted on Microsoft Teams. HEFESTIS positions itself as a sector-specific alternative to commercial vCISO/vDPO providers, drawing on a pool of named subject-matter experts and a member-driven threat-intelligence and best-practice community.

The business model is subscription-based membership fees paid by Higher and Further Education institutions, with no disclosed public pricing and quote-based, size-tailored fees. There are no external funding rounds, no parent company, and no public ticker; the company is private and member-owned, with the board composed of representatives from member institutions (e.g., SRUC, Ayrshire College, Edinburgh Napier University, University of the Highlands and Islands) and sector bodies such as UCISA. Revenue is therefore best understood as a cooperative fee pool rather than venture-scaled commercial ARR, and growth is funded entirely by retained membership income.

Name

HEFESTIS Ltd

Legal name

HEFESTIS Ltd.

Website

https://hefestis.ac.uk

Company type

Private

Operating status

Operating

Headcount range

11–50 employees

Short description

HEFESTIS Ltd is a not-for-profit, member-owned shared service organisation based in Stirling, Scotland, providing CISO, DPO, IRO, and ITIL ITSM shared services to UK Higher and Further Education institutions and adjacent public-sector bodies.

Ownership category

akta.pro rank

Headquarters

HQ city

Stirling

HQ country

United Kingdom

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Others

Revenue model

1. Membership Fees: HEFESTIS generates revenue through membership fees from its joint owners - Higher and Further Education institutions. Members pay for shared services including CISO-Share, DPO-Share, and UniDesk, achieving lower costs through pooled expertise and shared service delivery.

Go-to-market motion2 records

Distribution channels1 record

Marketing channels5 records

Core offering

HEFESTIS is a not-for-profit shared service organisation jointly owned by its member institutions that delivers pooled cybersecurity, data protection, information rights, and IT service management services to UK Higher and Further Education institutions and the wider Public Sector. Its core offerings are CISO-Share (integrated cyber risk management), Data Protection & Governance-Share/DPO-Share (named DPO services for GDPR compliance), IRO-Share (information rights administration), and UniDesk (an ITIL-aligned ITSM service built on the TOPdesk SaaS platform).

Product overview

HEFESTIS is a not-for-profit shared service organisation jointly owned by its members, providing information and change management services to Higher and Further Education and the wider Public Sector. The portfolio consists of four integrated shared services: CISO-Share delivers integrated cyber risk management with dedicated CISOs and a six-pillar 'Pathway' methodology; Data Protection & Governance-Share (DPO-Share) provides named Data Protection Officers for GDPR compliance; IRO-Share offers Information Rights Officer administration for data subject rights and FOI requests; and UniDesk delivers an ITIL-aligned ITSM solution built on TOPdesk. These services work together to provide comprehensive information security, data protection, and service management to member institutions.

Differentiator

Problem solved

Functional benefit

Brands

• CISO-Share: Integrated cyber risk management service for member organisations, providing cybersecurity expertise through a six-pillar consulting methodology known as the 'Pathway'.
• Data Protection & Governance-Share
• UniDesk
• IRO-Share

Products and services

• CISO-Share

Quantifiable outcome

• Accelerated cyber posture maturation with expert advice on modelling cyber risk, developing information security policy, designing procedures, and operational development on incident response and playbooks
• +1 more outcomes

Named customers39 records

Segments3 records

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration2 records

Feature3 records

Partnerships

One partnership is on record.

• TOPdeskcoreTechnology or IntegrationTOPdesk provides the technical SaaS platform for the UniDesk ITIL-aligned ITSM service. UniDesk manages the service on behalf of member institutions. TOPdesk's technical infrastructure enables enterprise-level ITSM solutions with all core ITIL processes built-in and tailored for education.

Scale indicators2 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• University of London Computer Centre (ULCC): Shared IT service provider owned by UK higher education institutions, delivering hosting, managed services and IT support to universities and colleges. Closely mirrors HEFESTIS's member-owned, HE-focused shared-service delivery model.
• Jisc: UK digital, data and technology agency for higher education, further education and research. Operates shared services (networking, Janet, cyber, cloud, data) on a subscription model to UK universities and colleges — directly comparable to HEFESTIS's member-owned shared-service model in the same UK HE/FE customer base.
• Phoenix Software: UK IT solutions provider focused on the education sector (schools, colleges, universities), supplying licensing, cloud and managed services. Comparable in education-sector focus and managed-service delivery but does not offer named DPO/CISO shared services.
• Data Protection People: UK-based DPO-as-a-service and data protection consultancy providing fractional DPOs, GDPR compliance and breach support to organisations. Directly comparable to HEFESTIS's DPO-Share/IRO-Share offerings, though without the education-sector specialism.
• Centiq: UK IT services and managed-service provider with a strong further-education and higher-education vertical, delivering cloud, infrastructure and end-user services to colleges and universities. Comparable ITSM-style delivery model for UK FE/HE members.

Broad incumbents

• BJSS: Large UK IT and cybersecurity consultancy delivering managed security, cloud and enterprise IT to public-sector and education clients. Adjacent competitor for CISO-style and managed-security work in the UK public sector.
• Tribal Group: UK-listed education software and services provider offering student information systems and education-sector technology to universities and colleges. Adjacent in customer base (UK HE/FE) but operates as a commercial vendor rather than a member-owned shared service.
• Capita: Large UK outsourcing group with a dedicated education services division providing managed services, IT and digital transformation to schools, colleges and universities. Comparable customer overlap with HEFESTIS but vastly broader portfolio and scale.

Others

• Janet (Jisc): The UK research and education network operated by Jisc, providing connectivity and cyber services to universities and colleges. Relevant ecosystem reference: HEFESTIS CISO-Share operates on top of Janet-connected institutions and shares the same UK HE/FE constituency.
• UCISA: UK professional membership body for digital, IT and information professionals in higher education. HEFESTIS's own board includes the UCISA Chief Executive (Deborah Green), and UCISA represents a closely adjacent community of UK HE IT leaders — overlapping stakeholder base though not a commercial competitor.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• YouTubeyoutube.com/channel/UCNYtBqgDP-ehRJuaHxYMlng
• LinkedInlinkedin.com/company/hefestis

Compliance1 record

Revenue estimate

Valuation estimate

Number of profiles

Profiles17 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about HEFESTIS Ltd