Some of what follows we do ourselves. Some of it we deliver through a partner network we've spent years assembling and vetting. You don't need to know or care which is which, because either way there's one contract, one team accountable, and one number to call when something goes wrong.
Plenty of firms quietly subcontract and hope nobody asks. We'd rather explain it, because the model is the reason a forty-person firm can get coverage that used to require a security department.
Security leadership, assessments, governance, policy, compliance, testing, and incident response. This is the part that depends on someone knowing your environment and your politics, so it stays with people you'll recognize by name.
Round-the-clock monitoring, endpoint and identity detection, next-generation firewalls, filtering, email security. We select the technology, deploy it, tune it, and manage it. You get one invoice and one escalation path, not a stack of vendor relationships to maintain.
We're deliberately technology-agnostic. If you've already paid for tools, our first move is making them actually perform rather than selling you replacements. Ripping out working technology to fit our preferences would be a good deal for us and a bad one for you.
Almost everyone begins with one of these, then adds from the catalogue below once we both understand the environment.
A working review with our CISO covering your technology, your policies, your procedures, and your people. We score you against a defined maturity framework and hand back a roadmap ordered by what would hurt most if it went wrong, with realistic timing and cost against each item.
This is the front door for almost everyone we work with. Scope and price are agreed up front, and the document is yours to keep whether or not you engage us further.
A full-time chief information security officer costs well north of $250,000 a year, and the good ones are hard to keep in a district or a forty-person firm. Our vCISO service gives you that seniority on a retainer: strategy, risk decisions, vendor evaluation, board and cabinet reporting, and someone accountable when the question is serious.
The advisory CIO service covers the same ground for broader technology decisions. Both work well as interim coverage during a search, and both are common for organizations that will never justify the full-time role. For higher education, the vCISO also fills the Qualified Individual role that the FTC Safeguards Rule requires.
Continuous monitoring across endpoints, identity, network, and cloud, with analysts reviewing what the tooling surfaces so an alert reaches you because it matters. Endpoint detection and response, identity threat detection, log management, and threat hunting run underneath it.
This is worth saying plainly to school districts: MS-ISAC moved to paid membership in October 2025 when its federal funding ended, and a lot of districts quietly lost round-the-clock monitoring they'd relied on for years without replacing it. If that's you, this is the gap.
The worst time to work out who you're calling is while your systems are encrypting. Retainer clients get a guaranteed response time, a named contact who already knows the environment, and a response plan written and rehearsed in advance.
We coordinate with your insurer and your counsel, help with disclosure obligations, and stay through the rebuild. We do this work for organizations that aren't on retainer too, but the difference in how the first six hours go is significant.
IBM's 2026 breach research found shadow AI involved in 43% of security incidents, more than double the year before, and that more than two thirds of organizations had no governance limiting unauthorized AI use. In the same study, 92% of organizations that suffered an attack on their AI systems had not implemented proper access controls.
Shadow AI discovery across browsers, extensions, SaaS, and endpoints. In most organizations the AI strategy is whatever staff signed up for themselves, and the first honest inventory is uncomfortable reading.
Acceptable use, approval workflow, vendor review, training, and a named person accountable. Mapped to NIST AI RMF and ISO/IEC 42001 where a certification would help you win business.
AI runtime defense at the gateway, guardrails against prompt injection and data leakage, least-privilege access to AI systems, and identity for agents that currently share credentials with nobody watching.
Turning on Microsoft 365 Copilot or Google Gemini doesn't create new permissions. It surfaces the ones you already had, including two decades of accumulated sharing mistakes. Microsoft publishes guidance on this because it is the single most common way a copilot rollout goes wrong. Fixing permission sprawl before you switch it on is cheap. Explaining afterward why the assistant summarized the salary file is not.
An AI that answers questions is a data problem. An AI that takes actions is an access problem. Agents routinely share credentials, have no individual identity, and can't be audited per agent. NSA published guidance on Model Context Protocol security in 2026, and CISA with its Five Eyes partners issued joint guidance on adopting agentic AI carefully. We build to both.
We work to the OWASP Top 10 for LLM Applications and the OWASP Top 10 for Agentic Applications, MITRE ATLAS, the CSA AI Controls Matrix, NIST AI RMF and the emerging NIST control overlays for AI systems, and ISO/IEC 42001.
This is the complete list, including the specialist work most providers our size send you away for. If something you need isn't here, ask anyway. The answer is usually yes.
Someone senior who owns the outcome.
Written down, current, followed, and defensible.
Somebody watching while you sleep, and a plan for the bad day.
Every laptop, phone, and Chromebook you're responsible for.
Who can reach what, and how you'd know if that changed.
The plumbing, including the parts nobody has looked at in five years.
Where the work actually happens now.
Getting back on your feet, and keeping data where it belongs.
Finding your gaps before somebody less friendly does.
The fastest-moving risk on this page, and the one most organizations haven't touched.
Your people will be the target long before your firewall is.
The work general providers don't do, because it only exists in schools.
We track the versions so you don't have to. A few that moved recently and catch people out: ISO 27001:2013 certificates expired in October 2025, PCI DSS 4.0.1 lost its grace period in March 2025, COPPA's amended rule reached full compliance in April 2026, and the Department of Defense suspended the CMMC Phase 2 transition in July 2026 while Phase 1 self-assessment stays in force.
Because the model is built for it, and because we'd rather answer this directly than let you wonder.
That's what the consultation is for. Thirty minutes, no cost and no commitment, and you leave knowing which two or three of these would move your risk the most.
