Project based
Professional consulting services on a project by project basis — the traditional model, where that is genuinely the right fit.
Fractional & virtual CISO
A CISO for the days you actually need one
Executive-level cyber and AI risk leadership at a fraction of the cost of a full-time CISO — scaled up when you are running a programme, and back down when you are not. Someone senior owns the AI risk agenda from day one.
Service models
Four ways to engage us.
Many mid-tier organisations find the traditional consulting model does not deliver sustainable capability. Every model below is tailored from an initial maturity and risk assessment.
vCISO on demand
A part-time CISO providing coaching, advice and support when you need senior judgement at short notice — including on AI adoption decisions.
vCISO as a service
A dedicated part-time CISO who becomes part of your management team, owns the cyber and AI risk agenda, and carries the accountability with you.
Co-sourced or outsourced
Outsource part or all of the management of your security programme and function, including AI governance and oversight.
What is included
Indicative services by model
| Service | vCISO on demand | vCISO as a service | Outsourced vCISO |
|---|---|---|---|
| Description | A part-time CISO providing coaching, advice and support | A dedicated part-time CISO who joins your management team | Full management of your security programme and function |
| Assess your cyber and AI risk | |||
| Current state maturity assessment | ✓ | ✓ | ✓ |
| Cyber and AI threat and risk assessment | ✓ | ✓ | ✓ |
| AI system, model and agent inventory | Optional | ✓ | ✓ |
| Regulatory compliance, including APRA CPS 234 | ✓ | ✓ | ✓ |
| Technical security assessments | Optional | Optional | Optional |
| Adversarial AI red teaming | Optional | Optional | Optional |
| Define your strategy | |||
| Cyber and AI strategy and roadmap | ✓ | ✓ | ✓ |
| Capability development plan | Optional | ✓ | ✓ |
| Business case and budget | Optional | ✓ | ✓ |
| Build your resilience capability | |||
| Governance, risk and compliance framework | Develop | Manage | Manage |
| AI governance framework and decision rights | Develop | Manage | Manage |
| Cyber and AI programme management | Optional | Optional | ✓ |
| Sourcing of cyber and AI services and vendors | Optional | Optional | Optional |
| Sourcing of cyber people and skills | Optional | Optional | Optional |
| Manage your risk posture | |||
| Executive and board reporting | Regular | Regular | Regular |
| Strategic advice, coaching and management meetings | Online | Regular | Regular |
| Oversight of security programme | On request | ✓ | ✓ |
| Risk assessment and remediation plans | ✓ | ✓ | ✓ |
| Information security policy framework | Develop | Manage | Manage |
| AI acceptable use policy and standards | Develop | Manage | Manage |
| Security culture and awareness, including safe AI use | On request | Oversight | Manage |
| Vulnerability assessment and penetration testing | On request | Regular | Ongoing |
| Third party, cloud and AI vendor risk management | On request | Regular | Ongoing |
| Incident response planning | On request | Regular | Ongoing |
| Deepfake and AI-enabled fraud readiness | On request | Regular | Ongoing |
| Executive support for incident management | On request | Defined role | Lead role |
| Coaching and mentoring of security staff | ✓ | ✓ | If required |
Indicative only — every engagement is scoped against your maturity assessment and risk profile.
Why it works
What a fractional model gives you that a hire does not.
Eight reasons organisations move to this model — and stay on it.
Flexibility
Complement your in-house team with specialist skills in the areas where you do not need someone full time.
Scalability
Ramp up when you kick off a programme, scale back when you return to business-as-usual.
Responsiveness
Access senior judgement at short notice, rather than waiting on a hiring cycle.
Cost effective
Typically a fraction of the cost of a full-time CISO, without a fraction of the capability.
Objectivity with inside knowledge
A long-term relationship gives you an insider’s context and an outsider’s willingness to say the awkward thing.
Continuity
CISO roles turn over roughly every two years. A team with backup means no gap in cover.
A range of expertise
Every CISO brings their own background. This model gives you several, for less than the cost of one.
Proven methodology
Built on a defined approach rather than simply placing experienced people and hoping.
AI risk gets an owner
In most organisations nobody is formally accountable for AI decisions. A fractional CISO closes that gap without waiting on a hire.
Evidence for the board
Regular reporting your directors can point to when a regulator, insurer or customer asks how AI and cyber risk are being governed.
Is it right for you
Who this model suits.
- Scale-ups not yet at the size where a full-time CISO is justified
- Smaller organisations whose workload does not warrant a permanent hire
- Organisations running a focused uplift that can scale back once target maturity is reached
- Teams with technical resources but no senior executive to provide oversight, challenge and blind-spot cover
- Anyone under regulatory pressure — including APRA CPS 234 — with no realistic path to a full-time CISO
Let’s talk
Know you’re ready. Embrace AI with confidence.
Whether you need a board briefing, a strategy you can defend, or a CISO for the days you actually need one.