Security leadership and incident readiness from one principal, without a full-time hire.
A virtual chief information security officer (vCISO) gives your cybersecurity program direction without a full-time hire. Security Leadership & Program covers fractional leadership, security risk assessments, and maturity roadmaps, with a named principal coordinating priorities and reporting to leadership. Incident Readiness develops response plans and playbooks, then exercises executive decisions and technical response through tabletop scenarios. Start with a risk assessment and roadmap when security decisions lack a clear owner. Start with incident readiness when an insurer, customer, or recent incident exposes gaps in your response plan. The same principal can connect findings from testing and compliance to the program.
Every engagement opens with your contracts, insurance application, open customer questionnaires, prior assessments, and existing incident response documents. We then agree in writing which decisions the principal owns and which stay with executives and counsel, which recognized frameworks anchor the work, which audience any exercise serves, and how often leadership hears from us.
The principal who scoped the work performs it: sampling the real state of your identity, endpoint, backup, and cloud systems with read access only, drafting the register, policies, and roadmap personally, and writing and facilitating each tabletop without keyboards or production access. When the same principal runs your penetration testing and compliance work, those findings feed the register and the exercise scenarios directly.
You keep artifacts that live under a named internal owner: the risk register, a current and target maturity scorecard, the board deck and decision log, the incident response plan and playbooks, and each exercise debrief and improvement plan. At an agreed checkpoint we rescore the affected risks or re-run the affected exercise module and package that record for insurers and assessors.
Each service below has its own scope, outcomes, and a direct path to the detail.
This core gives the security program a named owner and a written direction. Three services sit under it. vCISO and Fractional Security Leadership is the ongoing engagement: a part-time security leader runs the governance rhythm, owns the risk register and policy set, answers customer security questionnaires, and briefs the board. Security Risk Assessment is a bounded project that identifies the threats most likely to hurt you, rates each one on a clear, documented scale, and hands over a register with named owners and treatment decisions. Security Program Maturity Assessment and Roadmap scores the program against a recognized security framework, shows where you are today against where you need to be, and sequences the work that closes the gap. Fractional engagements usually begin with the risk assessment and the maturity roadmap, then run both as a program. Each service is scoped in writing, performed by the principal who scoped it, reported for engineers and for executives, and revisited at an agreed checkpoint to record what changed.
Explore Security Leadership & ProgramVirtual CISO services provide fractional cybersecurity leadership for risk management, vendor reviews, customer due diligence, and board reporting.
From $1,200/moThreat scenarios identified, rated on a documented scale, and tied to the owners, treatment decisions, and spending that reduce them.
From $6,000Your program scored against a recognized security framework, with a clear picture of where you stand today and a sequenced roadmap to close the gaps.
From $7,500Incident readiness covers the plan, the people, and the proof that they work together. Three services sit under this core. Incident Response Planning & Readiness builds or rewrites the policy, plan, playbooks, severity matrix, and notification decision tree against recognized incident response guidance. Executive Tabletop Exercises put leadership through the decisions an incident forces: activation, ransom posture, counsel and insurer engagement, and disclosure clocks. Technical Tabletop Exercises walk responders through detection, containment, eradication, and recovery on a scenario built from your own environment, whether on-premises, cloud, or hybrid. Most clients start with the plan, then test it with one exercise per audience on a shared scenario. The same principal reviews your documents, writes the scenario, facilitates the session, and writes the after-action report. Exercise findings land as redlines in the plan, not in a slide deck. Nothing here touches production. Readiness is documentation, discussion, and evidence, not incident handling on your behalf.
Explore Incident ReadinessAn incident response policy, plan, playbooks, and notification decision tree written for your organization and proven in a walkthrough.
From $6,000A facilitated, scenario-driven exercise that puts leadership through the decisions a serious incident forces, then records what has to change.
From $3,000A response-team walkthrough of detection, scoping, containment, eradication, and recovery on a scenario built around your own systems and logs.
From $4,200We’ll help connect your objective to the right scope, people, and evidence.
