Some of what follows we do ourselves. Some of it we deliver through a partner network we select and manage. We'll tell you which is which on any engagement, and either way there is one contract, one team accountable, and one number to call when something goes wrong.
The model is worth explaining, because it is the reason a college security office of two or a forty-person firm can get coverage that used to require a security department.
Security leadership, assessments, governance, policy, compliance, testing, and incident response. This is the part that depends on someone knowing your environment and your politics, so it stays with people you'll recognize by name.
Round-the-clock monitoring, endpoint and identity detection, next-generation firewalls, filtering, email security. We select the technology, deploy it, tune it, and manage it. You get one invoice and one escalation path, not a stack of vendor relationships to maintain.
We're deliberately technology-agnostic. If the tools you own work, we keep them and tune them.
Almost everyone begins with one of these, then adds from the catalogue below once we both understand the environment.
A working review with our CISO covering your technology, your policies, your procedures, and your people. We score you against a defined maturity framework and hand back a roadmap ordered by what would hurt most if it went wrong, with realistic timing and cost against each item.
This is the front door for almost everyone we work with. Scope and price are agreed up front, and the document is yours to keep whether or not you engage us further.
A full-time chief information security officer costs well north of $250,000 a year, and the good ones are hard to keep in a district or a forty-person firm. Our vCISO service gives you that seniority on a retainer: strategy, risk decisions, vendor evaluation, board and cabinet reporting, and someone accountable when the question is serious.
The advisory CIO service covers the same ground for broader technology decisions. Both work well as interim coverage during a search, and both are common for organizations that will never justify the full-time role. For higher education, the vCISO also fills the Qualified Individual role that the FTC Safeguards Rule requires.
An incident is a bad time to be choosing a responder and negotiating terms. Retainer clients get a defined response time written into the agreement, a named contact who already knows the environment, and a response plan written and rehearsed in advance.
We coordinate with your insurer and your counsel, help with disclosure obligations, and stay through the rebuild. We do this work for organizations that aren't on retainer too, but the early hours go very differently when a plan exists.
Continuous monitoring across endpoints, identity, network, and cloud, with analysts reviewing what the tooling surfaces so an alert reaches you because it matters. Endpoint detection and response, identity threat detection, log management, and threat hunting run underneath it.
For school districts: MS-ISAC moved to paid membership in October 2025 when its federal funding ended, and many districts lost the round-the-clock monitoring they had relied on for years. This service replaces it.
IBM's 2026 breach research found shadow AI involved in 43% of security incidents, more than double the year before, and that more than two thirds of organizations had no governance limiting unauthorized AI use. In the same study, 92% of organizations that suffered an attack on their AI systems had not implemented proper access controls.
Shadow AI discovery across browsers, extensions, SaaS, and endpoints. In most organizations the AI strategy is whatever staff signed up for themselves, and the inventory is usually a surprise.
Acceptable use, approval workflow, vendor review, training, and a named person accountable. Mapped to NIST AI RMF and ISO/IEC 42001 where a certification would help you win business.
AI runtime defense at the gateway, guardrails against prompt injection and data leakage, least-privilege access to AI systems, and identity for agents that currently share credentials with nobody watching.
Turning on Microsoft 365 Copilot or Google Gemini doesn't create new permissions. It surfaces the ones you already had, including years of accumulated sharing mistakes, which is why Microsoft's own guidance says to clean up permissions before the rollout. We do that review first, and it is usually the cheapest fix on the list.
An AI that answers questions creates a data-handling problem; an AI that takes actions creates an access problem. Agents routinely share credentials, have no individual identity, and can't be audited one at a time. NSA published guidance on Model Context Protocol security in 2026, and CISA with its Five Eyes partners issued joint guidance on adopting agentic AI carefully. We build to both.
We work to the OWASP Top 10 for LLM Applications and the OWASP Top 10 for Agentic Applications, MITRE ATLAS, the CSA AI Controls Matrix, NIST AI RMF and the emerging NIST control overlays for AI systems, and ISO/IEC 42001.
This is the full map of what we cover, directly or through partners we manage. The judgment work stays with our team; the platform work runs through partners we select and hold the contract for. If something you need isn't here, ask.
Senior leadership, on retainer.
Policy, audits, and the frameworks that apply to you.
Monitoring, and a rehearsed response.
Laptops, phones, and Chromebooks.
Accounts, access, and MFA.
Firewalls, segmentation, and the wireless estate.
Microsoft 365, Google Workspace, and cloud.
Backups, recovery, and data loss prevention.
Penetration testing and red team.
Shadow AI, governance, and runtime defense.
Training, phishing simulation, and deepfake awareness.
The requirements that only exist in education.
We track the versions so you don't have to. A few that moved recently and catch people out: ISO 27001:2013 certificates expired in October 2025, PCI DSS 4.0.1 lost its grace period in March 2025, COPPA's amended rule reached full compliance in April 2026, and the Department of Defense suspended the CMMC Phase 2 transition in July 2026 while Phase 1 self-assessment stays in force.
Because the model is built for it, and because we'd rather answer this directly than let you wonder.
The first conversation is free and takes about half an hour. You leave knowing which two or three of these would move your risk the most.
