Vorpcel / Services / Intelligence and advisory
Many companies need someone to lead security but do not need, or cannot yet hire, a full-time CISO. We take that role part time: we assess where you stand, build a program that fits your size and run it with your team.
At a glance
Without an owner, security becomes a list of tools bought after each scare, questionnaires from customers answered in a hurry and risks nobody has written down. The work is spread across IT and engineering, and leadership cannot tell whether the company is better protected this year than last.
A virtual CISO gives security an owner. We set priorities with leadership, turn them into a plan the team can follow, and report progress in terms the business understands.
Larger customers send questionnaires and contracts with security clauses you need to answer well.
The board or the founders want a clear answer and a plan, not a list of tools.
Many people do some security work and nobody owns the whole of it.
A standard such as ISO 27001 or SOC 2 is on the horizon and needs a program behind it.
Something happened and leadership wants to make sure it does not happen again.
You want the program started and the role defined before making the hire.
We start with a review of your current security against a recognized framework, such as the CIS Controls or ISO 27001, through interviews, document review and technical checks.
We turn the roadmap into a running program: policies people can follow, a risk register that is kept up to date and a security budget tied to those risks.
Larger customers send security questionnaires and ask for evidence. Boards ask whether the company is protected. We answer both with facts.
Before you buy a new tool or launch a new system, we review whether it solves the risk you have and how it fits with what you already run.
The assessment takes a few weeks. After that, the program runs on a fixed number of days per month, with a regular meeting and a named consultant who knows your company.
We learn the business, interview the people who run it and review the current controls.
We agree on priorities with leadership and write the roadmap and the budget.
We lead the program month by month and report progress, until you are ready for a full-time leader if that is the goal.
A typical start. The order changes with what your company needs first.
| Period | Focus | Result |
|---|---|---|
| Month 1 | Assessment: interviews, documents and technical checks | Maturity by area and the main risks, written down |
| Month 2 | Plan and quick wins: roadmap, budget and the most urgent fixes | Approved roadmap and the first risks reduced |
| Month 3 | Running program: policies, risk register and the first report to leadership | A program with owners, dates and a regular rhythm |
Twelve months of work in order, with effort and cost.
Short documents people can follow, approved by leadership.
Each risk with an owner, a decision and a review date.
A quarterly page on risks, progress and decisions needed.
Security reviews of the suppliers that handle your data.
Short sessions on the attacks your employees actually receive.
No. The recommendations follow your risks. When a Vorpcel product fits, we say so and why; when another product or a process change is the better answer, we recommend that.
Yes. We can write the role, take part in interviews and hand over the program, the documents and the history to the person you hire.
The consultant leads and coordinates. Technical work, such as detection engineering or application reviews, can be done by our other services or by your team, whichever makes more sense.
It depends on the size of the company and how much is already in place. We propose a number after the assessment and adjust it as the program matures.
We reply with a few questions about scope, then send a proposal with dates and price.