Six mandates.
One board.
We do not sell tools. We advise the people accountable for the outcome across information security, AI governance, and the sovereignty of your data.
Six disciplines, one operating posture.
The engagements boards actually need.
Executive Briefings
Quarterly, board-tailored intelligence on emerging threats, agentic AI, and the regulatory horizon.
ISMS Implementation
ISO/IEC 27001 information security management systems, aligned to NIS2 governance obligations.
AI-SMS Architecture
AI management systems that operationalize ISO/IEC 42001, NIST AI RMF and the EU AI Act.
Data Sovereignty Strategy
Jurisdictional mapping of where data lives, who can reach it, and sovereign infrastructure.
Board Advisory & Liability
Personal liability exposure under EU AI Act, GDPR, NIS2 and DORA translated into governance decisions.
Agentic Threat Simulation
Tabletop exercises that pit your executive team against autonomous adversaries.
No tools sold · Counsel that answers only to the board
Request a briefingTwo mandates, one decision.
Both are virtual officer mandates held by one independent advisor. The table shows where they differ, so you can identify which mandate matches your situation, or whether you need both.
| Dimension | vCISOVirtual Chief Information Security Officer | vCAISOVirtual Chief AI Security Officer |
|---|---|---|
| The question it answers | Is our information security governed, resilient and defensible at board level? | Is our AI secure, governed and defensible at board level? |
| Primary mandate | Enterprise information security leadership: strategy, governance, risk appetite and resilience across the organisation. | AI security leadership: AI agent and agentic-system security, frontier-model threat exposure and AI-specific risk. |
| Core scope | Security architecture, ISMS implementation, incident response readiness, third-party risk and board reporting. | AI inventory and classification, LLM, model, data and supply-chain security, AI red teaming, AI incident response. |
| Regulatory anchor | NIS2, DORA, ISO/IEC 27001, GDPR. | EU AI Act, ISO/IEC 42001, NIST AI RMF. |
| Board deliverables | Cyber risk register, control assurance, maturity trajectory and decision-ready board reporting. | AI system inventory, AI threat exposure assessment, ISO/IEC 42001 readiness and an AI security roadmap. |
| Typical trigger | Regulator or insurer pressure, an incident, board liability exposure or a gap in security leadership. | AI adoption outpacing oversight, agentic AI entering production, or AI risk questions arriving at the board. |
| Choose this when | The organisation needs accountable security leadership across the whole enterprise, independent of AI. | The organisation runs, or is adopting, AI systems that carry security and governance risk of their own. |