About
A consultancy built around one question
Can your customer verify what you are telling them? Everything Level Four does is downstream of that.
What we believe
Eight things we hold to
Values are cheap to write and expensive to keep. These are the ones that have cost us work, which is the only real test of whether a firm means them.
-
01
Do the right thing
The reason to hire an advisor is that you cannot verify everything they tell you. We treat that as an obligation rather than an opportunity. A standard that only holds while someone is watching was never a standard.
-
02
Safe, right-sized and frictionless
Security should be practical, business-enabling and protective — never overburdening, restrictive or in the way. Those pull in the same direction more often than people expect: a control that gets quietly worked around protects nothing at all. So we design for how your people already work, not for how a policy template assumes they do.
-
03
Customers are partners
Good security work should be within reach of the companies that need it, which means pricing that respects what you are actually trying to accomplish. When the right answer is smaller than what we would like to sell, the right answer is what we recommend — and if you are not ready for an engagement yet, we would rather tell you so than sell you one. We would rather be the firm you call again than the invoice you remember.
-
04
Outcome focused
We measure ourselves by what changes, not by what we hand over. A report that leaves everything exactly as it was is a cost, however good it looks — so every engagement is scoped to leave work already in motion, and we stay reachable while it moves.
-
05
Everything with quality
Work leaves here when it is right, not when the budget is used up. If a section is weak we rewrite it rather than ship it. We would rather hand you less that is solid than more that is padded.
-
06
Independent by construction
We never audit what we build. We issue no certifications, perform no examinations, and accept no fee, commission or referral payment from any vendor we might recommend. Independence that rests on a promise is not independence — it should be visible in how the firm is arranged.
-
07
Plain language
A finding that cannot be explained to the person who has to fund it is not finished. Framework references and control identifiers belong in the register; the conversation belongs in English.
-
08
Evidence over assertion
Everything we put in a deliverable, we can show you the basis for. It is the idea the firm is named after, and we hold ourselves to it before asking it of anyone else.
The name
Level four is where evidence starts
Assessments score controls on a scale. At zero the control is absent. In the middle it exists in some form — someone does it, sometimes it is written down, mostly it works. At level four the control produces evidence: a record a third party can inspect without taking anybody’s word for it.
Almost every company we meet is somewhere around three. The controls are real. What is missing is the artifact — and the artifact is the only part a customer, an auditor or a regulator can actually see. That is the gap this firm exists to close, and it is why the firm is called Level Four.
Leadership
Andrew Tubbs, principal
Thirty years across software engineering, cloud architecture and enterprise security, fifteen of them running security programs. Most recently Director, Information Security at Cox Automotive, serving as business information security officer to brands across the dealer technology portfolio — which is to say, years on the other side of this exact conversation, receiving the questionnaires and answering for the answers.
Before that, work in dealer-facing software going back to the first generation of manufacturer configurator and inventory sites. He holds the CISSP, CISM and C|CISO, and advises early-stage and nonprofit organizations on security strategy alongside the firm’s commercial practice.
- Certifications
- CISSP · CISM · C|CISO
- Most recent role
- Director, Information Security / BISO, Cox Automotive
- Contact
- Contact
The firm
Senior people, start to finish
Level Four LLC is a Florida limited liability company. Every engagement is led by a practitioner with three decades in the field, from the first call to the final deliverable. Nobody learns the work on your engagement, and nothing is handed down to a bench of juniors once the contract is signed. Where an engagement needs additional specialists, we bring them in under equivalent written confidentiality obligations and remain responsible for their work as for our own.
Clients range from SaaS, FinTech and eCommerce companies selling into enterprise procurement, to dealerships and the vendors that serve them, to small businesses and nonprofits receiving questionnaires written for organizations ten times their size. The method does not change with the client; the scope and the fee do.
We do not sell software, we do not resell tooling, and we take no commission from anyone whose product appears in a recommendation. If a recommendation ever carries an interest, it is disclosed in the deliverable that carries it.
Disclosures
Cox Automotive. The principal was most recently Director, Information Security at Cox Automotive and worked on several of its dealer-facing brands. Cox brands appear in the Assessed on Faith sample and are treated there exactly as every other brand is. The relationship is disclosed wherever those brands appear.
The study and the practice. The study is self-funded. Level Four has commercial relationships with companies in this market, which may include companies in the sample. No vendor paid for, commissioned, reviewed or influenced the study, and the dataset was collected before any such engagement was discussed.
Independence. Level Four does not perform SOC 2 examinations, issue certifications, or act as an auditor of work it has advised on. Where an engagement leads toward an attestation, the examining firm is independent of Level Four.