Business
Someone whose job is your security, at a fraction of a full-time hire.
Most companies under a few hundred staff cannot justify a full-time CISO or a 24x7 security team, so security becomes a side task for an IT manager until something goes wrong. A vCISO gives you a named person who owns the plan, answers to management and the board, and deals with customers, auditors and regulators. Managed detection gives that person eyes on your systems.
- A named vCISO with agreed days per month, a roadmap and quarterly board reporting
- Monitoring of endpoints, identity, cloud and email with alerts triaged by analysts
- Vendor, customer and regulator questions answered by someone who knows your environment
- Coordination of VAPT, awareness, compliance and incident response so they add up
Monthly retainer based on days per month and the number of endpoints and accounts monitored. Minimum term agreed in writing; no auto-renewal surprises.
Typical engagement
- Onboarding
- Monitoring live
- Monthly cadence
- Annual reset
Who this is for
- Startups between seed and Series B that need a security owner before an enterprise deal or audit
- Mid-sized companies whose IT manager is also the security team
- Regulated entities that must name a CISO or information security officer
- Companies recovering from an incident that want ongoing oversight
- Firms with several vendors (MSP, cloud, SaaS) and nobody holding them to account
- Boards that want a quarterly, honest picture of cyber risk
What is included
Security leadership
A vCISO with agreed days per month who sets the roadmap, owns policies, runs the risk register, chairs the security review and reports to management and the board quarterly.
Managed detection and response
Endpoint detection, identity and cloud log monitoring and email security alerts collected into a monitored platform, triaged by analysts, with agreed response actions and escalation to you.
Vulnerability and patch oversight
Continuous visibility of exposed services and missing patches, prioritised monthly, and followed through with your IT team or MSP.
Vendor and customer management
Security questionnaires answered, vendor assessments run, MSP and cloud providers held to agreed controls, and contracts reviewed for security clauses.
Compliance coordination
DPDP Act, CERT-In directions and, where applicable, RBI or SEBI frameworks or ISO 27001 tracked in one place, with evidence collected as part of normal work.
Incident readiness
An incident plan, a contact tree, an annual tabletop exercise, and priority access to our incident response team.
How we work
Onboarding
A baseline assessment of your environment, risks and obligations in the first month, with a twelve-month roadmap agreed with management.
Monitoring live
Agents and log sources connected, alerting tuned to your environment over the first weeks to reduce noise.
Monthly cadence
A monthly review of alerts, vulnerabilities, projects and vendor items; a quarterly report for the board.
Annual reset
Roadmap reviewed against what changed in the business and the threats, and the retainer re-scoped.
What you walk away with
- A named person accountable for security whom staff, customers and auditors can reach
- Earlier detection of compromise, with someone who acts on the alert
- A roadmap and risk register the board can follow and fund
- Compliance and assessment work that builds on itself instead of starting fresh each year
What we do not do
We would rather lose an enquiry than mislead you.
- We do not take over your IT operations or replace your MSP; we direct, verify and escalate
- Monitoring reduces the time to detect; it does not prevent every incident, and we will not claim it does
- We do not provide 24x7 phone response outside the agreed service levels
Frequently asked questions
How many days a month do we need?
Most companies between 50 and 300 staff use two to four days a month for the vCISO function, more in the first quarter and during audits. Managed detection runs continuously regardless. We size it after the baseline assessment and adjust at each quarterly review.
Can the vCISO be named as our CISO to a regulator?
Some regulators accept an outsourced or shared CISO for smaller entities, others expect a designated employee with our support. We tell you which applies and, where an internal designation is required, structure the arrangement so the named person has what they need.
What do you actually monitor?
Endpoint detection on laptops and servers, sign-in and configuration logs from Microsoft 365 or Google Workspace, cloud audit logs from AWS, Azure or GCP, and email security alerts, brought into one platform with rules tuned to your environment. The scope is written down so there is no ambiguity about what is covered.
What happens when an alert fires at night?
Alerts are triaged according to the agreed service levels, which are written into the retainer. High-severity alerts trigger the agreed automatic actions, such as isolating an endpoint or disabling a compromised account, followed by an escalation call to your named contact. Lower-severity alerts are reviewed the next working day. Full incident response is available under the retainer terms if containment is needed.
Tell us where you are starting from
Team size, what you run, whether you have an MSP, any regulator or customer requirements, and what has prompted this. We reply with a proposed scope and monthly cost within two working days.