A Security Program That Understands Vaults, Cash Rooms, and License Inspections.
Cybersecurity is one part of a cannabis operator's risk surface. Most cyber firms can't credibly help with cash handling and transport, inventory diversion, the camera and access-control rules written into your license, or what happens when your point of sale and tracking system go down on a Friday night.
$2,500–$7,500/month · same band as vCISO
Cannabis Operators Carry an Unusual Risk Profile.
Your product is the target. Flower, concentrates, and edibles are high-value, easy to resell, and attractive to outsiders and insiders alike.
Your financial workflow runs on more cash than almost any other retail business, because banking access is still limited. Cash counts, vault access, and transport are where the losses happen.
Your license depends on security. State rules usually spell out camera coverage, footage retention, alarm monitoring, access control, and inventory tracking, and an inspection finding can put the license at risk.
Your business depends on a handful of systems — point of sale, seed-to-sale tracking, cameras, alarms — that, if they fail, stop sales and put your compliance reporting at risk.
Most cannabis security vendors sell guards and cameras. Most cyber firms sell software. Neither one owns the whole risk.
Most Cannabis "Security" Sells You Guards and Cameras. We Run the Program.
Guards, cameras, and a checklist before inspection don't add up to a program. Someone still has to own the risk, decide what gets fixed first, and answer to the regulator and the owners between inspections. A vCSO program does that — and our operating arm enforces it.
The Guards-and-Cameras Model
- Coverage sold by the hour or by the camera
- A compliance checklist the week before inspection
- Alarm and camera alerts forwarded to you
- An annual training video
- Physical or cyber, rarely both
- No one accountable between inspections
Total 360 — A Program That's Operated
- A named program owner who shows up every quarter
- 24×7 managed detection with real containment
- Controls enforced — identity, backups, segmentation
- The whole risk surface: physical, cash, inventory, cyber, continuity
- Advisory + operations + GRC platform + regional delivery
- TX DPS-licensed · CPP / CISSP / CISM · since 2013
Eight ESRM Domains. One Program.
Eight of the thirteen ESRM domains apply directly to how licensed cannabis operators run. We run them as one continuous program — not eight separate vendor relationships.
Physical Security
Vault and cash-room access, camera coverage and footage retention that match your license, alarm response, visitor and vendor escort, and after-hours controls at cultivation, processing, and retail sites.
Loss Prevention
Inventory diversion and shrink, reconciliation between your tracking system and what's actually on the shelf, cash-count discipline, and investigations when the numbers don't match.
Workplace Violence & Robbery Response
Robbery and armed-incident response planning, de-escalation for budtenders and front-desk staff, terminated-employee risk, and a clear reporting path for threats.
Cybersecurity
Point-of-sale and seed-to-sale environment hardening, ransomware preparedness, MFA across all staff, and segmentation between cameras, POS, and the back office.
Information Security & Customer Data
Customer and patient data classification, ID-scan and purchase-history handling, access control for records, and data-sharing rules with your platform vendors.
Supply Chain & Transport Security
Product and cash moving between licensed sites, courier and vendor vetting, chain of custody, and third-party access to your facilities and systems.
Fraud Risk Mitigation
Payment fraud on equipment, nutrient, and packaging vendors, fake vendor and payroll changes, and controls on refunds and voids at the register.
Business Continuity
What happens when the POS or tracking system is down on a Friday night. When the cameras go dark and you have to decide whether to keep selling. When a key manager leaves the month before an inspection.
You Probably Need a vCSO If:
- A regulator, landlord, or insurer asked about your security program and you couldn't credibly respond.
- Your physical counts and your tracking system disagreed in the last 12 months and nobody could explain why.
- Cash gets counted with one person in the room. (Or the count-room camera was down that night.)
- You've never checked whether the footage an inspector or investigator asks for would actually be there.
- Former employees still have alarm codes, badges, or system logins.
- A vendor asked by email to change their payment details, and the change went through.
- Your robbery response plan is "call 911."
What an Engagement Actually Produces.
Within 90 days:
- Documented security program with a named program owner
- Site security assessment for each location, mapped to your license requirements
- Cash handling and vault procedures with dual control and documented counts
- Inventory reconciliation process between your tracking system and physical counts
- Camera coverage and footage retention verification
- Incident response plans tested against robbery, ransomware, and payment fraud scenarios
- Access review: alarm codes, badges, and system logins tied to current staff only
- Vendor and transport risk review covering couriers, distributors, and platform vendors
- Cyber-insurance renewal posture that survives carrier questionnaires
- Quarterly owners' risk briefing
We've Yet to Meet a Cyber-Only vCISO Who Can Answer All Four.
Ask any virtual CISO four questions:
What's your process when the vault count and the tracking system don't match?
How do you make sure a budtender's alarm code and login don't outlast their job?
What does robbery response look like for staff who've never been trained for it?
What's your plan when the cameras go down and someone has to decide whether to keep the doors open?
Cannabis operators don't have CISOs. They have owners, compliance managers, and general managers.
The role you actually need is a Chief Security Officer who understands the whole risk surface — physical, cash, inventory, cyber, continuity, people. Texas DPS-licensed (C10504801, F26294001). CPP, CISSP, CISM credentialed. Operating since 2013.
That's a vCSO. That's what we do.
The Total 360 Licensed Operator Program.
One program, scoped to your license and your sites — from security leadership to fully operated. Engagements start at $2,500/month, the same band as a vCISO, and far less than the cost of the incident they prevent.
Operator Security
vCSO leadership + ESRM program
From $2,500/mo
- Named program owner across all eight cannabis ESRM domains
- Site assessments mapped to your license requirements
- Cash, vault, and inventory controls
- Quarterly owners' risk briefing
Operator IT
Security-Controlled IT Operations
From $2,500/mo
- The six pillars, operated 24×7
- Identity, email defense, MDR, patching, backups
- Camera / POS / back-office segmentation
- Delivered by Total 360 Technology
Operator Complete
Advisory + operations, one operator
Custom
- Operator Security and Operator IT together
- GRC documentation via Total 360 Compass
- Extended delivery via Total 360 Barbados
- One operator behind what others stitch from four vendors
Not ready for a program? Start with one assessment.
A $2,500 fixed-fee assessment of your highest-risk domain — for most cannabis operators that's physical security or loss prevention — delivered in 3–4 weeks and credited in full if you start the program within 90 days.
Schedule a 30-Minute Risk Discussion.
No deck. No sales pitch. If a vCSO program isn't right for your operation, we'll say so on the call.
Schedule a Risk Discussion →