New to cyber security consulting - is this normal or am I in a bad consultancy?