Engagements Are Built. Not Sold.
Three weeks from first call to program kickoff. A 90-day fixed-price scope. Quarterly cadence after that. Pricing is published below — not behind a “request a quote” button.
From Risk Discussion to Quarterly Cadence.
Risk Discussion
What’s prompting the call? Where are the auditors, insurers, or customers pressing? No deck. No sales pitch.
Scoped Proposal
One-page scope. Fixed price. Named deliverables. 90-day commitment.
Program Kickoff
Current-state assessment. Framework selected. Risk register stood up.
Quarterly Cadence
Board-ready quarterly report. Risk register review. Forward-looking roadmap.
Annual Program Review
Top-to-bottom posture assessment. Framework re-scoping if needed. Renewal decision.
Pricing Is a Trust Signal. We Publish It.
Below 100 employees with an IT provider already in place, you don’t need a vCSO — you need a program. That’s Baseline: $4,950 to build it, $500/month to keep it. Above that, or with an auditor already scheduled, you need someone accountable — a vCSO, vCISO or vCAISO — and that starts at $2,500/month. Most clients run $2,500–$7,500/month depending on framework scope, headcount, and cadence.
Baseline
$500 /month after a $4,950 one-time program build
For businesses with an IT provider and no security leadership, facing SB 2610, an insurance renewal, or a customer questionnaire.
- Fixed scope, not monthly executive hours
- CIS Controls IG1 — one framework
- Quarterly review, annual re-assessment
- Two questionnaires or applications per year
Foundation
$2,500 /month
For organizations standing up a security program for the first time.
- 8 hours/month of executive time
- Quarterly board-ready report
- Framework selection and risk register
- Email and 24-hour response on policy questions
Risk-Managed
$5,000 /month
For organizations with active compliance pressure (SOC 2, HIPAA, CMMC, SB 2610, ISO/IEC 42001).
- 16 hours/month of executive time
- Quarterly board reporting + monthly working session
- Compass-backed evidence trail included
- Vendor and third-party risk program
Operational Risk Program
$7,500 /month
For organizations running the full ESRM program with named framework ownership.
- 20+ hours/month of executive time
- Monthly working session + quarterly board report
- Full Compass platform integration
- Incident response retainer and tabletop exercises
Baseline is a different product, not a cheaper vCSO. It buys a program kept current on a schedule. The three leadership tiers buy a security executive who owns it with you, available every month — as a vCSO, vCISO or vCAISO. AI security can also be added to an engagement already underway; we re-scope it at your next quarterly review. No multi-year lock-ins. Quarterly review. Cancel with 30 days’ notice. Hardware and software pass-through at cost when applicable.
Who We Don't Work With.
- If you are looking for the lowest-cost vCISO on the market, we are not the right fit.
- If you want a deck delivered and nobody to call when the auditor follows up, we are not the right fit.
- If your security strategy is “buy more tools,” we are not the right fit.
We work with organizations that have decided security and compliance are operating disciplines — not procurement line items. If that’s the conversation you want to have, the Risk Discussion is 30 minutes.
Ready to Start the Risk Discussion?
30 minutes with us. No deck. No sales pitch. If a vCSO, vCISO, or ESRM program isn’t right for you, we’ll say so on the call.
Schedule a Risk Discussion →Or call directly: 817-677-0515