A consultancy role is a limited advisory position, usually created to provide expertise without giving the holder full operational authority. In cyber security, the term matters because advisory titles can still imply access, influence, or proximity to sensitive policy, systems, or decision-makers. If the mandate is vague, outsiders may overread the role as evidence of control, coordination, or hidden ties.
Attackers and propagandists can exploit that ambiguity. A loosely defined consultancy can be used as a pretext for social engineering, for credibility laundering in disinformation, or for confusion about who is authorized to speak, approve changes, or handle data. Defenders reduce the risk by defining the scope in writing, limiting access to a need-to-know basis, publishing clear reporting lines, and separating advisory input from execution. Clear mandates make it harder to turn a routine appointment into a security narrative.