IRM (Information Risk Management)

IRM (Information Risk Management) is a UK cybersecurity consultancy founded in 1998 in Cheltenham, built on two lines of business: hands-on penetration testing and PCI-DSS qualified security assessor (QSA) work, and SYNERGi, a governance-risk-compliance (GRC) software platform sold as a standalone product. SYNERGi covers governance, risk, compliance, audit, vendor, and IT security management in one platform, positioned as a single source of truth for board and audit reporting rather than a point tool for one compliance framework.

French engineering and consulting group Altran acquired IRM in 2019 to build out its cybersecurity practice; when Capgemini acquired Altran in 2020, IRM became part of Capgemini Group, operating today as IRM Global Cybersecurity. IRM has retained its own brand, website, and SYNERGi product line rather than being fully folded into generic Capgemini IT services branding, which keeps it distinguishable as a dedicated GRC and testing practice inside a much larger diversified parent.

IRM reports serving over 750 customers across 25 countries, including multiple UK government divisions, built on more than two decades of QSA and penetration testing consulting credibility. Being owned by Capgemini gives IRM access to a much larger global delivery and sales organization than it could support independently, though it also means IRM’s cybersecurity-specific results are not separately broken out in Capgemini’s public financials.