About Skøut Advisory

At Skøut we help clients lean into the nexus of cybersecurity and strategy, bringing more clarity and comfort to a space too often the source of confusion and anxiety.

Theron McLarty

Founder and CEO

Theron has over 20 years experience in leading complex engagements at the intersection of cybersecurity, technology, and strategy. He has helped executives in several verticals, with deep experience in Financial Institutions (FI), Travel & Hospitality, and Consumer Packaged Goods (CPG).

Most recently, Theron founded the Cyber Resilience team in 2022 at ImagineX Consulting. In addition to leading the team, Theron led cyber projects across the continuum of client size and verticals, from Cybersecurity Maturity Assessments to Tabletops, or simulated attacks.

Prior to ImagineX, Theron was a leader in the Strategy & Operations team at Slalom Consulting, helping Atlanta area clients address needs such as developing brand and product go-to-market strategies, identifying KPIs, and designing product innovation strategies.

Prior to Slalom, Theron was in the Global Strategy team at InterContinental Hotels Group, leading global initiatives such as a consumer segmentation for emerging markets, resorts strategy and a 5-year technology roadmap.

Theron holds a JD-MBA from Northwestern University with majors in Finance & Marketing and a BSFS in Science, Technology and International Affairs from Georgetown University.

When he’s not working, Theron enjoys spending time with his family, traveling, reading history, and following his favorite sports teams.

Earl Knight

Principal, Offensive Security

Earl has spent more than two decades in enterprise IT, the most recent years focused on offensive security and security engineering. He has delivered a large portfolio of penetration tests across financial services, payments, insurance, healthcare and life sciences, logistics, higher education, and manufacturing — external, internal, application, API, wireless, and physical.

What distinguishes Earl’s testing is the decade he spent on the other side of it. Before he was assessing enterprise environments he was running them, and he has since led multiple enterprise endpoint detection and response deployments across a range of industries — including a rollout of tens of thousands of sensors completed over a single weekend — and built a FedRAMP-certified GovCloud security stack from the ground up. Having deployed the controls and then tested past them changes both the quality of a finding and the credibility of the fix that follows it.

Earl continues to operate an enterprise vulnerability management and cloud security posture program spanning dozens of cloud subscriptions and well over a hundred thousand assets, where he has driven critical cloud configuration findings to zero. He founded Stone-Knight Security in 2018 and works with Skøut clients on penetration testing, endpoint and cloud security engineering, and AI/LLM application security.

Earl holds a B.S. in Information Studies from Florida State University, completed while serving on active duty, and an active Secret clearance. He has served in the U.S. Air Force and the Florida Air National Guard since 2000, currently with the 202nd RED HORSE engineering squadron, including a deployment supporting Operation Inherent Resolve.

 

Deepak Gupta

Deepak Gupta

Principal Consultant, Risk Management

Deepak has over 20 years experience in enterprise risk management across all three sides of the discipline — insurer, broker, and corporate risk function. He has advised multinational organizations in several verticals, with deep experience in Luxury Goods, Food Processing & Packaging, and Energy.

Most recently, Deepak has served as Senior Manager at Loki Group, Inc., where he advises on mergers, acquisitions, divestitures, risk management, and insurance across engagements based in Atlanta and Geneva.

Prior to Loki, Deepak was Senior Insurance and Risk Analyst at Richemont in Geneva, supporting the corporate risk and insurance function for one of the world’s largest luxury goods groups. He also worked the broker side as a Broker with Symphony Group SA in Lausanne, and consulted independently on risk management for AbleWatts, Inc. in the energy sector.

Earlier in his career, Deepak spent nearly five years at Tetra Laval International in Lausanne, where he implemented risk management processes and internal controls and helped industry groups analyze insurable risks and navigate claims. He began in underwriting at American International Group in Atlanta, managing an $8 million book of business for multinational companies and using loss frequency and severity modeling to structure their insurance programs.

Deepak holds a BBA in Risk Management, Insurance and Finance from Georgia State University’s J. Mack Robinson College of Business.

When he’s not working, Deepak enjoys traveling with his daughter and discovering new restaurants and fine wines.

Frameworks and Controls

Our assessments, roadmaps, tests and exercises map to the frameworks your auditors, regulators, customers and cyber insurers expect — so the work you commission doubles as the evidence you need.

  • NIST Cybersecurity Framework (CSF) 2.0 — the backbone of our maturity assessments and roadmaps. Govern, Identify, Protect, Detect, Respond and Recover outcomes are scored, prioritized and turned into a risk- and effort-based plan.
  • NIST SP 800-53 Rev. 5 — control-level evidence behind assessments and remediation, including Contingency Plan Testing (CP-4), Incident Response Testing (IR-3) and Penetration Testing (CA-8).
  • NIST SP 800-61 Rev. 3 (2025) and SP 800-84 — Incident Response Recommendations and the Guide to Test, Training, and Exercise Programs. The methodology behind our incident response plans and our tabletop design, facilitation and after-action reporting.
  • NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment. The baseline for our penetration testing methodology, alongside PTES and the OWASP Testing Guide.
  • ISO/IEC 27001 and 27002 — ISMS maturity assessments and Annex A control gap analysis, with a roadmap toward certification or surveillance-audit readiness.
  • PCI DSS v4.0 — readiness assessments, gap remediation and Requirement 11.4 penetration testing for organizations that store, process or transmit cardholder data.
  • CMS ARC-AMPE — Acceptable Risk Controls for ACA, Medicaid and Partner Entities, the successor to MARS-E. Gap assessments and control mapping for state agencies, exchanges and their contractors.
  • HITRUST CSF — readiness and gap assessments for healthcare and life-sciences organizations pursuing e1, i1 or r2 assessment.
  • FedRAMP — control gap analysis and authorization readiness for cloud service providers pursuing Low, Moderate or High, built on the SP 800-53 baseline.
  • C2M2 — the Cybersecurity Capability Maturity Model for energy and critical-infrastructure operators.