Virtual CISO services that ship.
Virtual CISO services from a practitioner-led firm. Compliance readiness, penetration testing, and embedded security leadership for SMBs, growth-stage startups, and established teams that need senior firepower without the long hiring cycle.
- SOC 2 readiness in 2 weeks
- Embedded retainer, month-to-month
- Pentest included at no extra cost
Practitioner-led.
CISSP · OSCP · CREST
Pittsburgh-based.
Clients nationwide.
Framework-agnostic.
SOC 2 · ISO 27001
Month-to-month.
Cancel anytime.
How a vCISO partnership runs.
Engagements vary in scope and duration. The working rhythm stays consistent: threat-informed discovery in parallel with offensive testing, remediation and policy work shipped alongside your team, and recurring briefings for leadership.
Engagement phases
Kickoff
At the start of any engagement we confirm scope, get access, and agree on the two or three priorities that need to land first. Scope evolves as we go.
Discovery and offensive testing
Threat-informed assessment runs in parallel with real offensive testing. We rerun this work as scope expands or new systems land in production.
More engagement phases
Hands-on execution
Recurring sessions where remediation gets shipped, policies get authored, and customer security questionnaires get answered. Not advice. Implementation.
Leadership briefings
Board-grade briefings on cadence. You keep the materials for your board pack. Updates evolve with the program as priorities shift.
Audit-ready, attacker-tested.
Compliance work and offensive testing are usually two firms with two contracts. We run both inside one engagement, so the controls we implement reflect what an attacker would actually try.
Framework-native compliance
SOC 2, ISO 27001, HIPAA, PCI DSS, CMMC, NIST CSF. We run all of them. Most engagements start with SOC 2; frameworks stack cleanly when customer contracts require more.
Attacker-eyed security
Real pentests in every Sprint and Foundation. Continuous attack surface monitoring on retainer. Findings get prioritized by exploitability, not by CVSS severity rating.
What a retainer actually covers.
Sprints and Foundations are bounded. Retainers are not. Once we are embedded, the working areas below are continuous, not one-off. Scope shifts as your program matures, but it always covers these. It is the full scope of our virtual CISO services.
See all servicesPolicy authoring + access reviews
Real policies that match how your team actually operates. Quarterly access reviews with signed attestations from each system owner.
Vendor risk + customer questionnaires + trust center
Vendor inventory, tiering, and ongoing risk monitoring. Customer security questionnaires answered. Trust center kept current.
Audit support + evidence management
Auditor walkthroughs, control design defense, evidence curated across the audit window. We sit the meetings with you, not hand off a binder.
Vulnerability scanning + attack surface management
Continuous scanning that catches net-new exposures between pentests. Recurring authenticated scans on internal infra.
Endpoint and identity advisory
MDM and endpoint hardening. Identity provider audit, SSO and MFA enforcement, privileged access reviews.
Incident response + tabletops
Runbooks for the most likely scenarios. Annual tabletop with engineering and leadership.
Strategic roadmap + board briefings
Threat-informed 12-month roadmap. Board-grade briefings on cadence. Updates evolve with the program.
Sprint, Foundation, retainer.
A full-time CISO runs $250K to $400K a year, plus equity and benefits. We deliver senior leadership at a fraction of that. Productized or month-to-month. No long contracts.
- Kickoff call, gap analysis, policy inventory
- Light pentest on your app
- Prioritized remediation roadmap
- Exec readout deck and presentation
- Credited in full toward month one of retainer
- Monthly security reviews
- Policy review and recommendations
- Customer security questionnaire response
- Annual IR + DR tabletop exercise
- Slack and email access
- 48-hour response SLA
- Everything in Strategic vCISO, plus:
- Weekly syncs and embedded availability
- Hands-on policy authoring and remediation
- Audit preparation and fieldwork support
- Board and investor briefings
- Compliance platform admin (Vanta, Drata, Secureframe)
- Incident response leadership
- Same-day response SLA
- Threat-informed baseline (NIST CSF + MITRE ATT&CK)
- 12-month prioritized roadmap with owners
- Full pentest in days 31 to 60
- Closed first wave of high-priority gaps
- Board briefing and pentest summary at day 90
- First month of retainer credited if you continue
Annual billing means a single invoice for 12 months and a 15% discount on the Strategic vCISO retainer. Retainers remain cancellable with 30 days notice; unused balance prorated on termination. Sprint and Foundation pricing are flat-fee, not affected by billing cadence.
50% off the retainer for your first 12 months.
$2,500/mo Strategic vCISO, half the $5,000 list rate. Month-to-month, cancel anytime.
Frequently asked
What buyers ask first.
The short answers to the questions that come up on every discovery call. The full set is on the FAQ page.
See all 37 questions
Ready when you are
Your next move starts with a 30 minute call.
If vCISO.com is not a fit, we will say so on the call and point you toward someone who is. If we are, we will scope a Sprint, the 90-Day Foundation, or a retainer right then.