Cybersecurity services · Arlington, Virginia
A fractional CISO does, for businesses in Northern Virginia and DC.
30 minutes. A written scope before you commit.
We don’t run your IT, so we can judge it. Start with whichever service you need today.
Answer six questionsMost engagements start with one of these four moments. Each one has a concrete first step.
The carrier's questionnaire asks about controls nobody can confirm.
We confirm what is in place and document the evidence behind each answer.
A larger client sends a security questionnaire, and a contract waits on the answers.
We help you answer accurately, with the documentation to back it up.
Someone asks who owns cyber risk, and there is no clear answer.
An executive risk briefing, and a named owner from then on.
A compromised mailbox, a fraudulent invoice, a lost laptop.
Call 202-909-8237. We help you contain it, then close the gap it came through.
We lead your security program, then hold your AI tools and your website to the same standard. You can start with any one of them.
Someone has to own your security: set the standard, check the work, and answer to your board, your insurer and your clients. We take that job, whether you have an IT team, an outside provider or nobody yet.
Your team is already using AI. We decide with you what information may go into which tools, and how new tools get approved, so client data stays where it belongs.
Your website is the first thing a client checks and an easy way in for an attacker. We design and build it with security checked before launch, then host and maintain it.
Security work needs a clear owner. These questions help identify what to verify. Your answers stay on this page.
Question 1 of 6 · Ownership
You see the scope in writing before you commit. Urgent risks are handled first, whatever the plan says.
A renewal, a client questionnaire, an incident, or a sense that nobody owns this. Request a consultation and we'll arrange a time.
A 30-minute conversation with a senior security lead about your situation. If you'd like to prepare, the free cybersecurity assessment is optional.
Deliverables, timeline and terms in writing, before you commit to anything.
Baseline and priorities
Accounts, devices, vendors and exposure mapped, and the urgent risks named.
Roadmap and briefing
A 90-day plan and an executive briefing, in plain language.
Policies and fixes
Policies written, top fixes moving, oversight in place.
Monthly reporting
Roadmap ownership, reporting and incident leadership.
Keeping technology running and owning its risk are different jobs. Your IT may be run by you, one member of staff, a team or an outside provider. Someone still has to set the security standard, check the work against it and report to you on it, and the people who run it shouldn’t be the only ones checking it. That is the job we take. When we build something for you, such as a website or an automation, we hold it to the same written standard and show you the evidence.
Practical guidance for leaders, written by the people who do the work.
Exposed: Inside Risks and the New Architecture of AI Defense
The book behind our approach, written for leaders rather than technicians.
About the book
More in the full FAQ
A part-time chief information security officer: the senior person who owns your security program, sets priorities and reports to leadership, on a monthly retainer instead of a full-time salary. You may also hear it called a virtual CISO, or vCISO.
No. Some clients have an IT team or an outside provider, some have one person who handles it, and some have nobody yet. We work with whatever you have. If someone else runs your IT, we work alongside them.
Every engagement is scoped to the company, so we don't publish prices. What moves the effort: your size and the systems you run, the obligations you carry to insurers, clients and regulators, what is already in place, and how hands-on you need us to be. After a consultation you receive a written scope with the deliverables, timeline and terms before you commit.
Most engagements begin within two weeks of the first call. An assessment can start within days.
We're based in Arlington, Virginia, and work with businesses across Northern Virginia and Washington, DC. Much of the work is remote, with on-site sessions across the region.
A 30-minute call about your situation, then a written scope before you commit to anything.
Urgent concern? Call 202-909-8237
