How We Work
We believe security should enable your business, not slow it down. Our engagement model is designed to deliver strategic value quickly while building lasting capabilities. Here's how we work with clients from first conversation through ongoing partnership.
Discovery: Understanding Your Situation
Every engagement starts with a conversation—not a sales pitch. We want to understand:
Your Business Context:
- What stage is your company? What's driving growth?
- What customer, investor, or regulatory pressures are you facing?
- What security capabilities exist today (people, processes, tools)?
- What's worked in the past? What hasn't?
Your Immediate Needs:
- Is there a specific deadline (audit, customer requirement, board meeting)?
- Are there known gaps or recent incidents driving urgency?
- What does success look like in 90 days? In a year?
Your Constraints:
- Budget realities and competing priorities
- Team bandwidth and technical capabilities
- Organizational dynamics and decision-making processes
This discovery typically happens in one or two conversations. We're not looking to sell you—we're trying to understand if and how we can help. If we're not the right fit, we'll tell you and point you in a better direction.
Assessment: Seeing Where You Are
If we move forward, we start with an assessment phase—typically 2-4 weeks depending on scope. This isn't checkbox compliance or generic best practices. It's a practical evaluation of your security posture against your specific risks and requirements.
What We Assess:
- Technical controls across infrastructure, applications, and data
- Policies, procedures, and governance structures
- Compliance status against frameworks relevant to your business
- Team capabilities and organizational factors
- Third-party and vendor risks
- Incident response and recovery capabilities
How We Work:
- Interviews with key stakeholders (leadership, engineering, IT, legal)
- Technical review of configurations, architectures, and controls
- Document review of existing policies and procedures
- Gap analysis against relevant frameworks (SOC 2, ISO 27001, HIPAA, etc.)
What You Get: Assessment isn't about generating long lists of findings. We prioritize risks based on business impact, likelihood, and your specific context. You get a clear picture of what matters most, why it matters, and what to do about it.
Design: Building the Right Program
Based on assessment findings, we work with you to design a security program appropriate for your stage and goals. This isn't one-size-fits-all—it's tailored to your reality.
Program Design Includes:
- Security Roadmap: Prioritized initiatives phased over 12-18 months, aligned with business objectives and resource constraints
- Control Architecture: Technical and administrative controls that address identified risks while enabling business operations
- Policy Framework: Practical policies that teams will actually follow, not compliance theater
- Compliance Pathway: Clear steps toward SOC 2, ISO 27001, HIPAA, or other frameworks your customers require
- Tool Recommendations: Technology investments that make sense for your scale and needs
How We Work: We don't disappear and return with a deck. Design is collaborative—we work with your leadership and technical teams to develop approaches that fit your culture, capabilities, and constraints. Trade-offs are explicit. Decisions are yours.
Build & Operate: Ongoing Partnership
For most clients, the real value comes from ongoing fractional CISO engagement. We provide continuous strategic security leadership—typically a few hours to a few days per week depending on your needs.
Strategic Guidance:
- Security strategy aligned with business objectives
- Risk-based decision making and prioritization
- Board and executive reporting
- Vendor evaluation and security architecture decisions
- Incident response leadership when things go wrong
Program Execution:
- Driving security roadmap implementation
- Compliance preparation and audit coordination
- Policy development and maintenance
- Security awareness and culture building
- Team development and hiring support
Continuous Improvement:
- Regular security posture reviews
- Emerging threat and regulatory monitoring
- Control optimization based on operational experience
- Program maturity advancement over time
Flexibility: Engagement models range from advisory (monthly strategy sessions) to hands-on (embedded part-time leadership). We scale with your needs as requirements evolve. Some clients increase engagement during compliance sprints or security incidents, then reduce to maintenance mode.
How We Show Up
We tell you the truth. Not what you want to hear, not what's easiest to sell. If something isn't a real risk, we won't pretend it is. If you're underinvesting in something critical, we'll be direct about it.
We focus on what matters. Security programs can expand infinitely. We help you focus on risks that actually threaten your business and controls that actually reduce those risks.
We work with your constraints. Perfect security doesn't exist, and even if it did, you can't afford it. We design programs that work within real budget, team, and time constraints.
We build capability, not dependency. Our goal is to make you better at security, not to make you dependent on us. We'll help you build internal capabilities and hire when you're ready.
We stay until it works. We don't hand off a strategy deck and disappear. We stay engaged through implementation and iterate based on what's actually working.
Common Engagement Types
Security Assessment
2-4 weeksComprehensive evaluation of your security posture with prioritized findings and recommendations. Ideal starting point for companies unsure of their current state.
Fractional CISO
OngoingPart-time security leadership on a flexible, monthly retainer. Most common engagement model for companies needing strategic guidance without full-time overhead.
Compliance Sprint
3-6 monthsFocused engagement to achieve specific compliance certification (SOC 2, ISO 27001, HIPAA). Intensive support through audit completion.
Security Program Design
4-8 weeksComprehensive program design including architecture, roadmap, budget, and governance. Typically follows assessment or kicks off ongoing engagement.
Ready to Have a Conversation?
No pitch, no pressure. Let's talk about where you are and where you need to be.