About vCSO.ai
Operators, not consultants.
We’ve sat in the CSO chair, answered to the board, and shipped under real regulatory scrutiny. Now we help the next wave of leaders do the same — without hiring a full-time CSO to do it.
How We Practice
A short list of things we’ve decided.
-
We sit on your side of the table.
No channel partnerships. No rebates. No tool-reseller margins. Every recommendation is optimized for your risk posture — not our pipeline.
-
Every engagement has a named owner — not a team badge.
You get the operator who scoped the work. They write the memo, run the review, and answer the text at 9 PM. No account-manager relay.
-
We don’t resell tools. We recommend what actually works.
We’ve deployed most of the stack you’re evaluating. The recommendation comes from use — not from a vendor brief or a quadrant.
-
We write the memo you’d write yourself, if you had the time.
Clear, specific, board-ready. Not a 40-page deck with a maturity heatmap. A document you can forward to your CFO without an apology.
Our Story
We built the thing we wished we could have hired.
“After 15 years in the CSO chair, I kept watching the same pattern: great companies, smart boards, real risk — and advisors who couldn’t read the room.”
For 15 years I was CSO and CIO at Silicon Valley Bank — defending the bank of the innovation economy through crises, audits, acquisitions, and a collapse. I sat in the rooms where decisions got made under pressure and where the cost of getting it wrong was measured in real dollars and real reputations.
In that seat, you learn which advisors help and which ones hurt. The ones who helped had been in the chair themselves. The ones who hurt showed up with decks and frameworks and left before the hard part.
vCSO.ai exists because the companies I now advise — high-growth startups, venture-backed operators, and financial institutions modernizing under regulatory scrutiny — deserve the first kind of advisor and keep getting offered the second. So we built the thing we wished we could have hired: a team of operators, available fractionally, who know what matters before you do.
“The work happens between the meetings.”
The Team
Operators. Specialists. Builders.
Each person here has been an operator inside the same kind of company you're running. They write the memo, deliver the work, and answer the text.
Sonja Shevelyov
Head of Operations
Sonja has lived inside the scale-and-exit cycle — including an acquisition by Proofpoint. She runs operations here, which means she's the reason your engagement actually ships on time.
Angela Buenavista
Executive Assistant
Angela runs the Supper Club — the dinners where cyber operators, founders, and investors actually talk to each other. She also helps founders stop sounding like decks and start sounding like people.
Andrej Bosanac
Certified Ethical Hacker
Andrej runs our technical assessments. He's the one who finds the thing you didn't know was broken — and writes it up in a way boards and regulators can actually use.
Nicholas Carlson
AI Product Developer
Nicholas builds Theodolite and the other tools that let us deliver analysis in days that used to take consultant teams weeks. If you see a product here, he built it.
Berk Algan
GRC Advisor
Berk is the person you call when SOC 2 is the gate between you and your next round. He translates technical controls into the language auditors actually want to read.
Mike Korsak
Senior Project Management Advisor
Mike ran cybersecurity programs at Silicon Valley Bank — IAM, disaster recovery, data governance, incident response. He's been the person handed the hardest programs and asked to make them ship.
