Operate · Fractional leadership
Senior security leadership as a standing service: a named principal who owns your posture, your board reporting, and your customer conversations, without the executive hire. The Alvor platform carries the operational load, so the senior hours go on the decisions that need them.
Scope and price agreed in writing before any work. No obligation.
You are the founder, CTO, or COO carrying security alongside everything else, and customers have started asking questions that deserve a security leader's answer. The virtual CISO gives you that answer now, and a clean handover when you eventually hire.
Your security lead has left, or is leaving, and the cadence they carried, board reporting, risk decisions, customer reviews, cannot pause while you run a six-month search. A standing principal keeps it running and hands it to their successor intact.
The technical team is strong, but no one owns risk appetite, decision rights, or the conversation with the board. You need the leadership layer, not more hands on keyboards.
What you are commissioning
One named engagement from the Operate track backs this page. What it includes and what you hold are fixed in the service schedule before the retainer starts.
Operate trackRetainerStanding, sized to you
The leadership of an in-house team, without the hire.
Best for teams not ready for a full-time CISO.
Includes
Deliverables
The standardised assessments are fixed-fee. Every other engagement is scoped and priced in writing before you commit, from a one-off review to a managed service.
The method
You get one accountable senior leader, not a pool. They run a monthly governance rhythm: the risk register reviewed, decisions recorded, posture reported in a format your board can actually read.
Customer security reviews, due-diligence questionnaires, insurer renewals, and regulator correspondence are answered by someone who owns the posture, sitting on your side of the table.
Risk acceptances get an owner and an expiry date. Decision rights get documented. The program stops living in one person's head, which is precisely the failure mode most growing companies are one resignation away from.
When you hire in-house, the run book, the register, and the cadence transfer cleanly to your CISO, and we step back, or stay on as architecture depth behind them. The exit is designed in, not negotiated later.
Why this scales
A fractional leader is only as good as the system underneath them. Ours stands on the Alvor platform, so the evidence, scheduling, and tracking run themselves and the principal's hours go on judgement.
Questions
The retainer is sized to you in the service schedule, agreed in writing before it starts, and reviewed on your terms. The cadence, a standing governance rhythm plus availability for the conversations that arrive unscheduled, matters more than a raw hour count, and both are set out before you commit.
At some size you should, and we will tell you when. Until then, the work is senior but intermittent: a few decisions, a board cycle, a customer review. A virtual CISO gives you the seniority without carrying the executive salary, and the engagement is built to hand over cleanly to your eventual hire.
Yes. Customer security reviews, questionnaires, and audit interviews are part of the role, with one bright line: we are never your assessor. We prepare the posture and stand beside you; the certificate or attestation is issued by an independent body, by design.
The run book, risk register, decision log, and governance cadence transfer to your new leader as working artefacts, not a handover deck. Many engagements then end cleanly; you can also keep the practice on for the architecture depth a single hire rarely covers. The choice stays yours.
The virtual CISO leads you through an incident: decisions, communications, regulator and insurer obligations. Around-the-clock eyes-on-glass monitoring is deliberately not resold; where you need it, we scope a managed-detection provider into the operating model and hold them to the architecture.
One conversation, then the scope and the price in writing. Your enquiry arrives already marked for virtual ciso.