Fractional CISO for small business
Protect the business you've built. Prepare for what comes next.
Fractional CISO services for small and mid-sized businesses that need experienced security leadership without the commitment of a full-time hire.
I translate cybersecurity risk into business decisions, prioritize the work, and coordinate with your IT team or MSP.
What changes
Clearer priorities
Know which risks matter most and what to fix first.
Practical investment decisions
Put limited time and money where it reduces the most risk.
Stronger readiness for disruption
A plan your team can follow if systems go down.
The owner's reality
You're managing customers, cash flow and growth. Security needs direction, too.
Most owners I talk with aren't ignoring security. They're fitting it in around everything else, with a small team and no clear answer about where the next dollar should go.
Questions owners ask me
Are we protecting the systems that keep revenue moving?
Are our current tools and services addressing our biggest risks?
Can we answer our insurer's questions accurately?
What happens if our team loses access to email, billing or customer records?
Who is responsible for coordinating the response?
1 in 4
small and midsize businesses don't believe they're investing enough in cybersecurity.
That's rarely about not caring. It's about where to put limited resources, and that's a decision I can help you make.
Business impact
When systems stop, the business feels it.
Work stops
Orders, appointments, production or services are delayed.
Cash stops
Invoicing and collections are interrupted while expenses keep coming.
People stop
Employees can't work, and leadership gets pulled into recovery.
Trust takes a hit
Customer information is exposed and confidence is damaged.
Growth money goes to recovery
Funds meant for the next hire or location pay for cleanup instead.
A serious loss or a long interruption can strain a business's ability to keep operating. The work is about shortening that interruption and limiting the damage before anything happens.
58%
of claims came from business email compromise and funds transfer fraud.
Disruption doesn't always start with a dramatic hack. It often starts in everyday email and payment workflows.
Why work with me
Before I was a CISO, I was a CEO.
When I was a CEO, I doubled revenue from $2.5 million to more than $5 million. I know how much work goes into building a business, and how quickly a disruption can put it at risk.
So I read a security finding the way an owner would: what does it put at risk, what does it cost to fix, and what happens if we wait?
The technical finding
The business question
An exposed account
Could someone redirect a payment or get into systems they shouldn't?
An untested backup
How long could operations be down if we had to restore?
An unreviewed vendor
How much do we depend on them, and what sensitive information do they hold?
Practical guidance, every time
What matters
The risks that touch revenue, customers and operations.
Why it matters
In business terms, not technical jargon.
What to address first
A clear order of work.
What investment is proportionate
Spending matched to the size of the risk.
Fractional CISO
Experienced security leadership, sized for your business.
A fractional CISO is a security executive who works with your business on an agreed part-time basis.
Someone sets the priorities with you, advises leadership, keeps the work moving and connects technical changes to what the business is trying to do.
Who does what
I lead
The agreed security strategy and advisory work.
Your IT team or MSP
Operational knowledge and the agreed technical changes.
Your leadership
Approval of investment and risk decisions.
It builds on the team you already have. It doesn't replace it.
Cybersecurity risk assessment
Know where you stand. Know what to do next.
Start with the business
Priorities, critical systems, sensitive information and operational dependencies.
Assess what's in place
Review existing protections and identify the gaps.
Build the roadmap
Every item shows business impact, priority, recommended action, owner and timing.
Separate urgent from phased
What needs attention now, and what can be planned over time.
Every roadmap item includes
The result is a defensible basis for spending limited time and money.
Cyber insurance readiness
Put your business in a stronger position for cyber insurance.
Review the controls and evidence your application asks about.
Coordinate with you, your IT team or MSP, and your insurance broker.
Find gaps early enough to fix them before renewal.
Support accurate answers that reflect what is actually deployed and practiced.
Insurers can make specific security controls a condition of coverage, and requirements vary by carrier and by risk.
For example, Coalition lists five essential cyber insurance requirements:
The goal is a stronger application that helps your broker pursue suitable coverage and competitive terms. Coverage, rates and claims decisions remain with the insurer.
Policies and AI governance
Clear policies that support how your team actually works.
What the policies cover
Company systems
Who can access what, and how.
Devices
Laptops, phones and personal devices used for work.
Data
What's sensitive and how it's handled.
AI
Which tools are approved and how they're used.
For AI specifically
Each policy comes with a procedure your team can follow and plain guidance for employees, including an Acceptable Use Policy.
The benefit: Fewer ambiguous decisions, and a consistent foundation as you hire, add vendors and adopt new technology.
AI guidance starts from NIST's voluntary AI Risk Management Framework and is tailored to your organization.More on AI governance
Operational resilience
If something happens, your team should know what comes next.
Detection readiness
Monitoring coverage, who owns alerts, how employees report problems, and escalation with IT or your MSP.
Incident response readiness
Decision-makers, contacts, communications and practice exercises.
Ransomware readiness
Preventive controls, protected backups, restore testing and response coordination.
IT disaster recovery
Restoration priorities, tested against what the business needs first.
Business continuity
How essential work continues while systems are unavailable.
The goal: spot events sooner, coordinate the response and get operations back.
70%
of ransomware events involved both encryption and data theft.
Recovery planning has to cover two problems: getting systems back, and dealing with information that's been exposed.
Source: Coalition, 2026 Cyber Claims Report, 2025 claims data
Investment and growth
Plan the investment before an incident forces the decisions.
Preparation buys time to prioritize, budget, test and coordinate. After an incident, those same decisions get made under pressure.
If you're not sure where you stand, that's normal. An assessment answers the question and gives you a manageable first step.
The program grows with
Progress is measured by
How engagements usually unfold
Assessment
A defined first engagement with a prioritized roadmap.
Implementation coordination
I coordinate the work with your IT team or MSP.
Ongoing leadership
Fractional CISO support, if and when you need it.
FAQs
Questions owners ask before we start.
What does a fractional CISO do for a small business?
Sets security priorities, advises leadership on risk and investment, oversees progress and coordinates with your IT team or MSP, on an agreed part-time basis.
How do you work with our IT team or MSP?
I lead the security strategy and advisory work. Your IT team or MSP brings operational knowledge and makes the agreed technical changes. I don't sell managed services or run infrastructure, so I'm not competing with them.
Can we begin with a risk assessment?
Yes. Most engagements start there, because it gives you a clear picture and a prioritized roadmap before you commit to anything else.
What will our roadmap include?
Each item shows the business impact, priority, recommended action, owner and timing. Urgent actions are separated from improvements that can be phased.
Can you help with cyber insurance readiness?
Yes. I review the controls and evidence your application asks about and coordinate with your IT team and broker. Coverage, rates and claims decisions remain with the insurer.
How do incident response, disaster recovery and business continuity differ?
Incident response is how your team detects, decides and communicates during an event. Disaster recovery is restoring systems and data in priority order. Business continuity is how essential work keeps going while systems are down.
What does an engagement cost, and how much of our team's time will it require?
It depends on scope. After our first conversation you get a written proposal with the scope, the fee and the time we'll need from you and your team, before anything starts.
Next step
Let's identify what matters most for your business.
In 30 minutes we'll talk about your business, what concerns you right now and a sensible place to start.