ESRM Program · Assets Cluster
Brand Protection
Find the fake accounts, lookalike domains, and impersonators early.
$2,500 fixed-fee assessment 3–4 weeks Credited toward the vCSO program
Led by Don Oxman, CPP, CISSP, CISM. Licensed by Texas DPS. In business since 2013.
Impersonation is usually spotted by a customer first.
Brand protection is one of thirteen domains in our Enterprise Security Risk Management (ESRM) program, and part of the Assets cluster with Physical Security, Cybersecurity, and Information Security. It covers your name and the people who speak for it: a homebuilder whose logo appears on a fake rental listing, a CEO whose cloned voice calls the controller.
In most companies, brand protection falls to marketing, who watch reviews and social media but have no process for impersonation or counterfeits. Legal gets pulled in late, and IT hears about a lookalike domain only after someone has paid a fake invoice. Executives post freely, and nobody has looked at what their public footprint reveals about them or their families. We help you spot impersonation early and agree in advance on who acts and how.
What can go wrong with your name
Lookalike domains
A domain one letter off from yours is used to send fake invoices to customers or to pose as your company with suppliers and job applicants.
Fake accounts
Fake social profiles and listings use your logo to run scams, post fake job offers, or sell fake products. Customers blame you when they get burned.
Executive impersonation
Cloned voices and deepfake video calls are used to pressure staff into wiring money or sharing data, often timed for when an executive is traveling.
Executive exposure
Posts by leaders and their families can reveal home addresses, travel plans, and schedules, or start a controversy that lands on the company.
Counterfeits & IP misuse
Knockoff products, unauthorized resellers, and copied content cut into revenue and leave customers with poor quality they associate with you.
Reputation attacks
Fake reviews, coordinated complaints, and false claims spread fast. Without a plan, the response gets improvised and can make things worse.
Five questions for leadership
- Would you know within a day if someone registered a domain that looks like yours?
- Can staff verify an urgent payment request that sounds like it came from the CEO?
- Who decides whether to report, answer, or ignore a fake account using your name?
- Has anyone reviewed what your executives’ public profiles reveal about them and their families?
- Are your trademarks registered, and does anyone check for misuse?
If you answered “no” or “not sure” to any of these, that is where we would start. Most of these gaps cost little to fix before an incident and a great deal to fix after one.
How an Engagement Works
Every ESRM domain starts with the same fixed-fee assessment. If you decide to continue, we credit the fee toward the program, and brand protection becomes part of your vCSO engagement alongside whichever other domains you need.
Brand Protection Assessment
- Interviews with leadership, marketing, finance, your counsel, and the executive assistants who field requests.
- Structured review: a 15-question risk profile, a 25-point practices checklist, and a maturity score from 1 (Initial) to 5 (Optimized).
- Exposure review: lookalike domains, fake accounts, executive public footprints, and how your name is used online.
- Gap analysis against recognized practice and your own incident history.
- Written report and prioritized roadmap, walked through with your leadership team. The report is yours whether or not you continue.
The fee is credited in full toward the program if you start within 90 days.
The vCSO / ESRM Program
- Assess (Q1): we start from your assessment findings.
- Build (Q2): a monitoring plan for domains, social media, and marketplaces, a response playbook, and clear roles for marketing, legal, and finance.
- Verification rules for payment changes and urgent executive requests, so a cloned voice or fake email cannot move money on its own.
- Executive guidance on social media and public profiles for leaders and their families, kept practical.
- Operate (Q3+): we stay on as the named owner, with quarterly reviews of what monitoring finds and reporting to leadership or your board.
Month to month. Cancel with 30 days’ notice. About the vCSO program →
Impersonation Response
- Takedown requests for fake accounts, listings, and lookalike domains.
- Evidence packages for your counsel when legal action is needed.
- Executive footprint review for a leader and their family.
- Deepfake incident support when a cloned voice or video targets staff.
Why Total 360
Security and reputation together
Impersonation is often the first step in fraud or a cyberattack. We treat it as a security problem, so the fake account and the fake invoice get handled together.
Independent recommendations
We don’t resell monitoring services and we take no commissions. We recommend the level of monitoring that fits how often your name is actually targeted.
Experienced leadership
Led by Don Oxman: M.S. in Security Management, CPP, CISSP, CISM. U.S. Army and AT&T background. In business since 2013 and licensed by Texas DPS.
Common questions
What does a brand protection assessment cost?
$2,500, as a fixed fee. It usually takes three to four weeks from kickoff to the readout. If you start the vCSO program within 90 days, the full fee is credited toward it.
What do we get at the end of the assessment?
A written report with your maturity score from 1 (Initial) to 5 (Optimized), the gaps we found against recognized practice and your own incident history, and a prioritized roadmap. We walk your leadership team through it, and the report is yours whether or not you continue.
Do we have to sign up for the full program?
No. The assessment stands on its own. If you continue, brand protection runs inside the vCSO program at $2,500 to $7,500 a month depending on scope. It is month to month, and you can cancel with 30 days’ notice.
Can we buy impersonation response without the program?
Yes. They are available to any client. Billed per case, quoted in advance.
Will you replace the people and providers we already use?
No. We work alongside your IT provider, attorney, insurer, and other advisors. We set the standard, help them meet it, and check that the work gets done.
Start with a 30-minute Risk Discussion
No deck and no sales pitch. Tell us what has already happened with your name online and what concerns you. We’ll give you an honest read on the gaps and send a scoped proposal within five business days.
Schedule a Risk Discussion Or call 817-677-0515 · info@total360security.com