About vCSO.ai

Operators, not consultants.

We’ve sat in the CSO chair, answered to the board, and shipped under real regulatory scrutiny. Now we help the next wave of leaders do the same — without hiring a full-time CSO to do it.

vCSO.ai team at event

How We Practice

A short list of things we’ve decided.

  • We sit on your side of the table.

    No channel partnerships. No rebates. No tool-reseller margins. Every recommendation is optimized for your risk posture — not our pipeline.

  • Every engagement has a named owner — not a team badge.

    You get the operator who scoped the work. They write the memo, run the review, and answer the text at 9 PM. No account-manager relay.

  • We don’t resell tools. We recommend what actually works.

    We’ve deployed most of the stack you’re evaluating. The recommendation comes from use — not from a vendor brief or a quadrant.

  • We write the memo you’d write yourself, if you had the time.

    Clear, specific, board-ready. Not a 40-page deck with a maturity heatmap. A document you can forward to your CFO without an apology.

Our Story

We built the thing we wished we could have hired.

“After 15 years in the CSO chair, I kept watching the same pattern: great companies, smart boards, real risk — and advisors who couldn’t read the room.”

For 15 years I was CSO and CIO at Silicon Valley Bank — defending the bank of the innovation economy through crises, audits, acquisitions, and a collapse. I sat in the rooms where decisions got made under pressure and where the cost of getting it wrong was measured in real dollars and real reputations.

In that seat, you learn which advisors help and which ones hurt. The ones who helped had been in the chair themselves. The ones who hurt showed up with decks and frameworks and left before the hard part.

vCSO.ai exists because the companies I now advise — high-growth startups, venture-backed operators, and financial institutions modernizing under regulatory scrutiny — deserve the first kind of advisor and keep getting offered the second. So we built the thing we wished we could have hired: a team of operators, available fractionally, who know what matters before you do.

Nick Shevelyov speaking at an event
Nick Shevelyov · Founder & Principal Advisor
A Supper Club evening in session

“The work happens between the meetings.”

From a recent vCSO Supper Club

The Team

Operators. Specialists. Builders.

Each person here has been an operator inside the same kind of company you're running. They write the memo, deliver the work, and answer the text.

  • Sonja Shevelyov

    Sonja Shevelyov

    Head of Operations

    Sonja has lived inside the scale-and-exit cycle — including an acquisition by Proofpoint. She runs operations here, which means she's the reason your engagement actually ships on time.

  • Angela Buenavista

    Angela Buenavista

    Executive Assistant

    Angela runs the Supper Club — the dinners where cyber operators, founders, and investors actually talk to each other. She also helps founders stop sounding like decks and start sounding like people.

  • Andrej Bosanac

    Andrej Bosanac

    Certified Ethical Hacker

    Andrej runs our technical assessments. He's the one who finds the thing you didn't know was broken — and writes it up in a way boards and regulators can actually use.

  • Nicholas Carlson

    Nicholas Carlson

    AI Product Developer

    Nicholas builds Theodolite and the internal tools behind the website, content systems, and product workflows. If you see a product here, he helped build it.

  • Berk Algan

    Berk Algan

    GRC Advisor

    Berk is the person you call when SOC 2 is the gate between you and your next round. He translates technical controls into the language auditors actually want to read.

  • Mike Korsak

    Mike Korsak

    Senior Project Management Advisor

    Mike ran cybersecurity programs at Silicon Valley Bank — IAM, disaster recovery, data governance, incident response. He's been the person handed the hardest programs and asked to make them ship.