A part-time CISO,
without the $300K salary
Cyber insurance rules, SOC 2 audits, CMMC, and board pressure after every big breach are hitting mid-market companies hard, and a full-time CISO is hard to justify. We own your security program on a monthly retainer, with real enterprise experience, not a certificate and a checklist.
Who Hires a Fractional CISO
This isn't for everyone. It's for companies where something specific has made security impossible to ignore.
Your sales team is losing deals because prospects send a 50-question security questionnaire and no one can answer it. A CISO fixes that.
Insurers now require MFA, endpoint detection (security software on every computer), incident response plans, and documented controls. You need someone who can get that done.
Customers or DoD contracts require you to be ready for an audit. You need a real security program, not a policy document someone found online.
Your investors or board want to know who owns security and how exposed you are. Right now you have no good answer.
Something happened. A breach, a vendor compromise, a failed audit. You need a plan and someone to own it.
You are about to hire your first security person and you need someone senior to write the job description, run the interview, and set the direction.
What the Work Looks Like
How it goes, from the first call to ongoing support.
First 30 days: we learn where you stand, find your real risks, and write them up in a risk register (a ranked list of risks) based on your actual business, not a generic template.
We build the security program your company needs at its stage. Policies, vendor management, access controls, incident response. The pieces auditors and enterprise customers ask about.
Monthly calls, board reporting, security questionnaire responses, vendor security reviews, and a direct point of contact when something happens.
SOC 2 readiness, CMMC Level 1 and Level 2 prep, cyber insurance questionnaires. We get you ready for the specific compliance target your business is working toward.
Real Background
Why This Is Different
Built security tools at JPMorgan Chase
Bank security is a different level. Heavy regulation, real attackers, no room for mistakes. That experience carries straight over to what your company needs.
Led engineering at DENSO
Security for embedded and industrial (OT) systems, where a mistake doesn't just mean a breach. It means physical harm. Supply chain security, mapping how an attacker could get in at every layer (threat modeling), systems where safety is not optional.
Security built into the foundation
Most virtual CISOs hand you a policy doc. Security that holds up under real scrutiny comes from knowing how the system is actually built. We've built systems from the ground up with security in mind from day one.
You work with the senior person
No junior staff running your engagement while a senior person signs off. You work directly with the person who has the background.
How It Works
Initial call
We talk through your situation, your business, and what is actually driving the need. No pitch. We figure out whether this is the right fit and what the scope should be.
Security assessment
The first month is always a structured assessment: where you stand, where the gaps are, which risks come first, and what needs to happen in what order.
Program build
Months two and three: we build the parts of the security program your situation requires. Policies, controls, incident response, vendor reviews.
Ongoing retainer
Once the foundation is in place, we stay on as your advisor: board reporting, new vendor reviews, compliance prep, questionnaire answers, and being there when something comes up.
What This Is Not
Better to say this upfront.
You can buy a SOC 2 policy template online for $500. This isn't that. We build a real security program that holds up when it gets tested.
If you have 5 employees and $500K in revenue, this isn't the right fit yet. It's for companies where security has a real business impact.
A SOC 2 report means nothing if the controls behind it are hollow. The goal is a security program that actually works. The certification follows.
Let's Talk About Your Situation
A compliance deadline, a deal stuck on a security questionnaire, or a board asking questions you can't answer? That's where we start. One conversation, no commitment.