The questions clients usually ask first.

A vCISO usually works at management level: security strategy, governance, risk ownership and programme direction. A technical advisor works closer to the systems and the people building or running them. We review designs, interpret findings and help technical owners decide what to do next. Some organisations need one role; some need both.

No. Your internal team keeps ownership of its systems, and formal testing is separate work. We can help define a sensible test scope, make sense of the results and work out what should be fixed first. The actual changes stay with your delivery team unless we agree otherwise in writing.

It depends on the package. The initial response time is stated on the packages page and runs in business days. An initial response means we have acknowledged and reviewed the question; it is not a promise that a complex issue will be fully resolved within that period.

Most months include one or more scheduled working sessions, questions between sessions and a short list of agreed actions. The exact mix depends on what is happening in your business. One month may centre on a pentest report; the next may be a cloud change or a difficult client security question.

Yes. We treat client technical information as confidential and can put the appropriate confidentiality terms in place before detailed material is shared. We will also tell you when we do not need a sensitive file or production detail to answer the question.

The Advisory Clinic is intended for smaller teams that can collect a few questions for one monthly session. If the need is genuinely one-off, tell us what you are dealing with. A separately quoted review may make more sense than putting you on a retainer.