Fractional CISO & Security Advisor
You know security matters. What's less clear is where to start, what to fix first, and who makes those calls when no one on staff owns security. I help you understand where you stand, what matters most, and what to do next.
Start with the free checklist: The Security Questions Every Growing Business Should Be Able to Answer. A self-scoring readiness check you can work through on your own.
These are reasonable questions, and they usually come up long before anyone in the business has the time or background to answer them properly. Working through them in order is most of what a security program is.
Before anything else, you need an accurate picture. A security foundation assessment looks at how your business actually operates and where the real exposure sits. Most often that is identity and access, and the email and productivity platform your team lives in all day. A maturity assessment puts that in context, so you can see how far along you are rather than only what is broken.
A list of findings is not a plan. I turn what we learn into a prioritized roadmap: what to do now, what can wait, and what you can reasonably set aside. That includes the practical pieces: security policies people will actually follow, and having your answers in order before a cyber insurance renewal or a customer security review.
Most security work stalls at the follow-through. As a fractional CISO I stay involved month to month: keeping the roadmap current, reviewing new vendors and SaaS tools before they are woven into your business, confirming your backups would genuinely get you running again, and shaping security awareness that feels useful rather than like a compliance exercise.
AI is arriving in businesses faster than the guidance around it. The useful questions are plain ones: which tools are people already using, what business data goes into them, and what needs to be written down. This is more a governance question than a technical one, and it is manageable with clear expectations.
Worth being clear about: this is advisory work. I do not sell products or take over your systems. Implementation happens through your existing IT staff or MSP, who know your environment. My part is making sure the right work is happening in the right order.
Security should leave a business more confident, not more anxious. Fear is a poor basis for decisions. It tends to produce spending on whatever seems most urgent that week, rather than on what actually reduces risk.
Good security is practical and sustainable. It fits the way your business already works, it can be maintained by the people you already have, and it is prioritized so the most important things happen first. A recommendation that cannot survive a busy quarter is not the right recommendation.
It should also be understandable. You should be able to explain where your business stands to your leadership team, your insurer, or a customer without needing a translator. That means talking in terms of business outcomes rather than technical controls.
Most growing businesses do not need enterprise security. They need experienced guidance, applied to their actual situation.