Solution
Fractional CISO (vCISO) Services
Security leadership without a full-time hire. Our CEO, Zeeshan Sultan, leads your security programme, backed by an advisory board of practitioners from banking, healthcare and govtech.
For: Companies facing audits, regulators or enterprise buyers without a security leader.
Scope: Incident response here means planning and rehearsal. We don't offer an incident response retainer.
Team certifications: CISSP, CISM and CCSP, held across our team.
Every engagement is quoted after a scoping call, based on what we would actually test. How engagements are priced
What's included
- Security strategy, roadmap and risk register
- Policies, controls and audit coordination
- Answers to customer security questionnaires
- Incident response planning and tabletop exercises
- Executive and board reporting
Related services
Who is a fractional CISO for?
A fractional CISO is for companies that need a security leader but not a full-time one yet. The pressure usually comes from an upcoming audit, a regulator, or enterprise customers sending security questionnaires that nobody inside the company owns.
Our CEO, Zeeshan Sultan, leads the engagement, backed by an advisory board of practitioners from banking, healthcare and govtech.
How does the engagement run?
It runs in 6 steps, each agreed with you before it starts.
- 01
Discovery
We talk to your leadership and engineers, review the policies and controls you already have, and list your upcoming audits and customer commitments.
- 02
Risk register and roadmap
We record the risks that matter to your business and set out a roadmap to reduce them, in an order you can fund.
- 03
Policies and controls
We draft the policies your audits need and work with your team on the controls behind them.
- 04
Audits and questionnaires
We coordinate your audits and answer customer security questionnaires.
- 05
Incident response planning
We write your incident response plan and rehearse it with your team in tabletop exercises.
- 06
Reporting
Leadership and the board get regular reports on risk, progress and the decisions that need them.
What do you receive?
- Security strategy, roadmap and risk register
- Security policies and control documentation
- Completed customer security questionnaires
- Incident response plan and tabletop exercise results
- Executive and board reports
What do we need from you?
- An executive sponsor who can decide on risk and budget
- Access to the people who run your systems, and to existing documents
- Your audit dates, regulatory deadlines and customer commitments
Questions
Does the fractional CISO handle incidents?
Not as a retainer. Incident response here means planning and rehearsal: we write the plan and run tabletop exercises with your team. We don't offer an incident response retainer.
Who will we work with?
Our CEO, Zeeshan Sultan, leads the engagement, backed by our advisory board. CISSP, CISM and CCSP certifications are held across our team.
Do you work with UAE regulators' requirements?
Yes. For companies in the UAE we map the programme to the regulators and data protection laws that apply to you.
Fractional CISO in the UAE →Other engagements
Book a call
Book a 30-minute call
Pick a time that suits you. We'll talk through what you're building and where your security stands, then suggest where to start.
Cyphlon
1:1 Consultation Call
30 min
Google Meet
An introductory call with our engineers about any engagement: a pentest, continuous testing, managed AppSec, security engineering, agentic AI security or a fractional CISO. We'll ask about your stack, your deadlines and what your customers or auditors expect, and tell you plainly if we're not the right fit.