Virtual CISO · By the hour or on retainer · Amherst, New Hampshire
It is the call I get more than any other, and it is almost always one of three. A prime contractor’s flow-down asking how you handle controlled information. A cyber insurance application or renewal. A customer’s supply-chain questionnaire that has to come back before the contract moves. Somebody needs an answer only a security executive can give, the deadline is not yours, and you do not have one on staff.
I am that executive, on retainer or by the hour. $275 an hour, no contract, no minimum — and the first thirty minutes are free. If it takes less than that, there is no bill.
What people actually call about
Eight years running a managed security firm taught me what the phone is really for. Almost nobody calls asking for a security program. They call with one of these.
Answering the form properly is the CISO’s job. You cannot answer it correctly without doing the risk work behind it — and most people asking want someone else to carry the accountability for the answer.
A prime’s flow-down, a cyber insurance application, a customer’s supply-chain questionnaire. Someone else set the deadline and the questions are written in a language the owner does not speak. This is the most common request I get, by a wide margin.
Everyone has backups. Almost nobody has restored one and timed it. The real answer is usually days longer than the owner assumes, and learning that on a quiet Tuesday costs far less than learning it on a Friday night.
An email that does not smell right, a vendor asking for access, a payment instruction that changed. One page naming who to call and what not to touch, and a number that reaches a security executive rather than a ticket queue.
So who is supposed to answer them?
Every one of those forms is really asking the same thing: is anyone here accountable for security? Most small and mid-sized companies have to answer no — and not because they were careless. Because the job was never separated out from the one next to it.
Every company with computers, email and customer data has two separate jobs. Most treat them as one, and that is where the exposure starts.
Fixing the printer, setting up laptops, managing Wi-Fi, restoring a backup. That is IT, and a good IT person or managed service provider earns every dollar you pay them. I am not that, and I am not trying to be.
Which accounts could an attacker use to move money. What happens when the file server is encrypted on a Friday night. Whether you are actually meeting the security terms in your cyber policy, your bank’s requirements, your customer’s contract — or only think you are.
The second job is a Chief Information Security Officer’s. It is a leadership role, it reports to the owner, and it is not the help desk’s to absorb. Asking your IT provider to do it is asking the people who build the thing to also be the people who audit it.
Large companies separate the two. Small and mid-sized companies almost never do. That is not a coincidence, and it is why they get hit.
Three forms, one underlying question
Every business has at least one of these, and most have all three.
They look like three different forms. They are mostly the same twenty questions, and the insurer’s version is the bluntest: a cyber application is a ransomware checklist with a signature line. Making those answers true is the same work as not becoming the claim.
Which is the part most people miss. The form is not paperwork standing between you and the contract. The form is the risk assessment, written by someone who has to pay if you are wrong.
It asked whether you have multi-factor authentication on email and remote access. Whether backups are tested and kept where ransomware cannot reach them. Whether endpoints run EDR, and on what share of machines. Whether you train staff, patch on a schedule, and have an incident response plan. Someone answered — often from memory, often optimistically — and an owner signed underneath.
If an answer was wrong, the carrier has grounds to contest the claim at the one moment the policy was supposed to matter. Not because anyone lied. Because nobody checked.
I do not sell insurance, I do not interpret your policy language, and I will not tell you whether a claim will pay — that is your broker’s job and your carrier’s call. I tell you what is true about your systems, so that what you sign is true too. The signature on that application is yours personally.
The review
Most firms find two or three answers that would not have survived a claim investigation. Most of those are fixable in an afternoon.
This is not form-filling. To answer the questions correctly somebody has to establish what is actually true about your systems, which is the risk work — and then stand behind the answer. That is the job you are hiring, whether it arrives as a form or a retainer.
An auditor would hand you the findings and leave — independence is their product, and it bars them from fixing what they found. I sign it because I own it. The same weight behind the signature, the opposite relationship: I am the one who has to make it true again next year.
The offer
Somebody has to decide what gets fixed, answer the insurer, brief the staff, and run the incident at two in the morning. For companies too small to carry a full-time security executive, that seat is the virtual CISO retainer.
Start by the hour if that suits you better — no retainer, no minimum, and the first thirty minutes cost nothing. Every price is fixed or published before the first call.
Published pricing
The method
Most security vendors sell a checklist and a pile of tools. The checklist is the same for everyone, which should tell you something.
I start from intelligence. What does your business look like to someone deciding whether to attack it? Who is actually going after companies like yours, and how are they getting in this quarter — not in a 2019 whitepaper. Then I rank what I find: worst first, most likely first. Then I build against those threats, in that order, and I stop.
The ranking is the product. Anyone can list a hundred things you could fix. Knowing which six matter, and that the other ninety-four can wait, is the difference between a security budget and a security program. You pay for protection you need and nothing you don’t. That is what intelligence buys: not a bigger security bill, a smarter one.
Detection is retrospective by construction — something has to occur before it alerts. Warning is the only part of the stack that operates before the event, which is the only point at which you still have options.
Buying controls before naming the threat means the threat model exists anyway — it is just implicit, unexamined, and usually inherited from a vendor whose interests are not yours.
Credentials already for sale, a supplier being compromised this week, a principal's address in a broker file, a persona being built to impersonate your CFO. None of it generates a log on your network until it is too late.
Assessments state confidence, grade sources, and name the alternative explanation where evidence is thin. That is what makes them reviewable — and what lets you hold us to them afterward.
Intelligence is how the job gets done. Deciding what to do about it is the job.
How an engagement runs
Whether you arrive with a form or with a retainer, the work is the same five steps. Most of it happens in the first two weeks; after that it is maintenance.
What the business actually runs, who can move money, where customer and regulated data lives, and which systems a form or a contract is really asking about.
Not what the policy says — what is actually configured. Multi-factor coverage, endpoint protection, backups that have been restored and timed, who holds administrator rights.
Worst first, most likely first, against what an adversary working your sector is doing now. The ranking is the product. Anyone can list a hundred fixes.
The form answered as you can truthfully answer it, the evidence behind each line, and a named Chief Information Security Officer standing behind the answer.
The short list of what was not yet true, in order, with what each costs. Your staff or your IT provider execute. I verify.
On a retainer the cycle repeats on a cadence, because the answer that was true last year is the one you have to affirm again this year.
Also available on their own
The retainer includes the intelligence work. These are the same products sold standalone, for companies that want the assessment without the seat — or want to start there and decide later.
Who targets your sector and by what method, what your digital footprint already exposes, the risks that follow ranked against your tolerance, and the standing requirements that come out of it. The baseline everything else is measured against.
Standing collection against your requirements, a monthly written risk assessment, a warning product the moment a threshold trips, and a quarterly briefing to the board or the owner.
The digital footprint of a named individual and their family: data-broker exposure, doxxing and threat chatter, residence and travel context — what a stranger can assemble, how they would use it, and what comes down first.
Pre-close diligence on a target: breach history, exposed credentials, adversary interest, third-party and supply-chain risk, digital footprint, and the warning items that follow you past closing.
How I work
Boundaries
This does not replace an MSSP for security operations or an MSP for running IT. It is the layer neither of them sells: someone whose job is to know what is coming and to say so in writing.
Who this is for
Eight years running a managed security firm, with direct operating experience in the first four. I know what an adversary wants from each of these, because I have defended against it.
The risk attaches to the person, not to a company. The digital footprint is the attack surface, and nobody on staff does this work.
CMMC and 800-171 pressure, a prime demanding answers, and a nation-state adversary that is genuinely interested in the program you support.
Drawings, specifications and client property data that are valuable to a competitor and to anyone casing the buildings you designed.
Process knowledge worth stealing, a supply chain worth impersonating, and a plant floor where downtime is measured in shifts.
Deal-timeline pressure and real transaction risk. The cost rides on the deal rather than on operating expense.
Examiners expect a threat intelligence function and a defensible risk assessment. Boards want a named analyst, not another dashboard.
Daily intelligence brief · blog.monadnockcyber.ai
Published every weekday under a byline. Confirmed facts and unverified claims are labeled throughout, with the risk implication called out where there is one. It is a working sample of the product: read a week of it and you will know exactly what you would be buying.
Start here
Bring it to a thirty-minute call. We go through what it is actually asking and what you can truthfully answer today. The thirty minutes cost nothing, and if that is all it takes, there is no bill.
No form in hand? The self-assessment is free and takes about twenty minutes. You get a scored result and the gaps in writing, and you keep it either way.
Connect
If something looks wrong
Call before you change anything. The evidence worth having is the same evidence that gets destroyed by cleaning up. Answered day or night.