vCISO · Our flagship service · From $10,000 a month
A named senior leader embedded in your company. Owns real risk, speaks for your program with customers and partners, governs how you use AI, holds your MSP accountable and watches the whole picture. Managed GRC is included.
The model
Most vCISO offerings are an analyst behind a dashboard or a monthly check-in call. Steadfast's vCISO works inside your company: carries your email address, sits in your Teams or Slack, joins your leadership meeting, and shows up on your customer's security call for any deal in review.
The role is hands on. Your vCISO supports infrastructure builds, wires resiliency into operations, and does the work when there is no security hire to delegate to. And every engagement includes a Managed GRC tier underneath, so compliance operations run month to month without executive attention.
In your chat tools, your leadership meeting and your customer's security review. Not an advisor you schedule.
Assessor side experience with HITRUST and SOC. Knows how AI is changing both the threats you face and the questions your customers ask.
A named compliance operations manager runs the platform, evidence, policies and the audit between meetings. The leader has a team.
What your vCISO owns
A living risk register tied to your real systems. We rank what a customer or an attacker would hit first, fix that, and tell you what can wait.
Rules for how your team uses AI, review of AI features that touch sensitive data, and answers for the AI questions now in customer diligence. ISO 42001 ready when you need it.
Your vCISO joins the security review, answers the questionnaire in your voice and speaks to the customer's CISO as a peer.
Buy side or sell side. Security diligence, findings in plain language and a 90 day integration plan. We have sat on both sides of the table.
Control health from your compliance platform and detections from your monitoring, read by the same person every week. What should be true and what is happening, in one view.
When something looks wrong, a senior person decides what it is, who to call and what to tell customers. Tabletop exercises that executives ask to extend.
We hold your MSP to the security work in their contract: endpoint protection, patching, vulnerability management, backups.
An annual security and compliance budget with quarterly reforecasts, renewals run against a savings target, and top risks reported in dollars.
What each seat gets
Own the program end to end, speak for security with customers and the board, direct the compliance team, guide architecture and platform decisions, and help hire a full time CISO when you are ready.
Security reviews run as a sales function with a turnaround commitment, a senior voice on customer calls, diligence readiness for M&A and fundraising, and every deal tracked through review with a date in and a date out.
An annual budget with quarterly reforecasts, auditors consolidated against a savings target, partner pricing on audits and pen tests, cyber insurance renewal support, and top risks in dollars.
Status in writing: phase, done, risks, next and who owns each item.
Status report with KPIs and a one page finance view.
Executive business review, plus a two page board summary in business language.
Budget, insurance renewal and roadmap refresh.
Why premium
| A typical vCISO retainer | Steadfast vCISO | |
|---|---|---|
| Model | A block of advisory hours | An embedded executive with a named team |
| Compliance work | Your staff collect evidence | Managed GRC included |
| Customers | You answer the questionnaire | Your vCISO is on the call |
| Your MSP | You manage them | We hold them to the contract |
| AI | Not in scope | Usage policy, feature review, diligence answers |
| Reporting | A deck when asked | In writing every week. Two pages for the board every quarter |
From $10,000 a month, Managed GRC included. Moves the price: a Professional tier underneath, more than one customer audit a quarter, board and fundraise cadence, M&A activity. Fixed once scoped.
Roadmap, risk register and a board summary. Fixed fee, $7,500 to $15,000. The leader arrives with a plan.
