Fractional security leadership
vCISO services
Senior security strategy and program ownership without the full-time CISO price tag. We act as your security lead — setting priorities, aligning stakeholders, and maintaining an operating cadence quarter to quarter.
- 6 to 20+ hrs per month
- Named senior advisor at every tier
- Monthly engagement, ongoing
What vCISO actually means in practice
Most compliance consultants hand you templates and disappear. A vCISO engagement is different — we own the security program alongside you, setting strategy, managing the roadmap, and making sure the work actually gets done. You get a named senior advisor who knows your environment, your risk profile, and your business goals.
Who this is right for
- Founders and CTOs who need security leadership but cannot justify a full-time hire
- Companies with a GRC platform they purchased but never fully configured
- Series A/B companies entering enterprise sales cycles where security reviews are a recurring obstacle
- Post-audit organizations that need the program to keep running year-round
- Regulated companies (healthcare, FinTech) requiring board-level security reporting
Pricing tiers
- Security roadmap (6–12 month horizon)
- Monthly risk register review
- Core policy review (up to 5 policies)
- Monthly advisory summary + action items
- Questionnaire support (up to 2/month)
- GRC platform setup — basic configuration
- Everything in Launch, plus:
- Compliance program management (SOC 2 or ISO maintenance)
- Vendor risk reviews (up to 5 vendors/month)
- Security awareness program oversight
- 1 tabletop exercise/year (standard 3-hr scenario)
- Quarterly executive security report
- GRC platform optimization + evidence automation
- Customer security review support (up to 10/month)
- Everything in Growth, plus:
- Named senior CISO-level advisor (20+ hrs/month)
- Board-level security presentation (quarterly)
- Advanced vendor risk (up to 20 vendors/month)
- 2 tabletop exercises/year (standard 3-hr scenarios)
- Annual policy library review and refresh
- IR plan maintenance and annual update
- Unlimited customer questionnaire support
- Cyber insurance alignment review (annual)
Typical client
- 5 to 300 employees, Series A/B stage
- No dedicated security hire — CTO or IT lead stretched thin
- Active enterprise sales with growing security review volume
- GRC platform purchased but not fully operational
What you get
- Named advisor who owns the program with you
- GRC platform oversight and evidence quality
- Regulatory change monitoring and alerts
- Growing questionnaire response library that absorbs future requests
GRC platform included
All vCISO tiers include GRC platform setup and ongoing management. For clients without Drata or Vanta, we include access to a complimentary compliance management platform for the duration of your engagement.
Your security program, built by people who've been in the room.
Book a free 30-minute call. We confirm what tier fits your situation and whether we are the right partner.