Cyber Risk Assessment Services
Turn Findings into a Roadmap Leadership Can Defend.
-
15 years as CSO at Silicon Valley Bank (2007–2021), the bank of the innovation economy
-
$200B+ in assets defended at enterprise scale
-
Design partner to Palo Alto Networks, Zscaler, CrowdStrike, FireEye, and Eclypsium
-
Author of Cyber War and Peace; board member, Bay Area CSO Council
-
Trusted advisor to PE/VC firms, cyber product companies, and enterprise boards
-
15 years as CSO at Silicon Valley Bank (2007–2021), the bank of the innovation economy
-
$200B+ in assets defended at enterprise scale
-
Design partner to Palo Alto Networks, Zscaler, CrowdStrike, FireEye, and Eclypsium
-
Author of Cyber War and Peace; board member, Bay Area CSO Council
-
Trusted advisor to PE/VC firms, cyber product companies, and enterprise boards
-
15 years as CSO at Silicon Valley Bank (2007–2021), the bank of the innovation economy
-
$200B+ in assets defended at enterprise scale
-
Design partner to Palo Alto Networks, Zscaler, CrowdStrike, FireEye, and Eclypsium
-
Author of Cyber War and Peace; board member, Bay Area CSO Council
-
Trusted advisor to PE/VC firms, cyber product companies, and enterprise boards
What You Receive from the Cyber Risk Assessment
Most organizations do not have a finding problem. They have a prioritization problem. Sprint A connects technical and policy evidence to business exposure, ownership, and the sequence of work.
Technical assessment report
Evidence, affected systems, control gaps, and material exposure documented for the teams responsible for action.
Risk surface map
A Theodolite-accelerated view connecting assets, dependencies, findings, and business scenarios.
Policy and compliance gap analysis
Current evidence compared with the frameworks, obligations, and operating expectations relevant to the business.
Prioritized roadmap and board summary
Work sequenced by business impact, with a separate executive view of exposure, ownership, and decisions.
Focused engagement: A 30-day Sprint A posture review, delivered as a technical report, business-impact roadmap, and board-ready executive summary.
The Proprietary Differentiator
Powered by Theodolite™
A scanner can identify a technical condition. An audit can test evidence against defined criteria. A checklist can track obligations. A cyber risk assessment connects those inputs to critical services, material scenarios, current controls, and business consequences.
Theodolite accelerates the posture review and risk-surface mapping. Senior operators then apply judgment to the evidence, challenge assumptions, and translate the result for the teams executing the work and the leaders overseeing it.
Learn more about Theodolite →How It Works
-
Map the business and technical scope
Identify critical services, data, systems, third parties, obligations, and the decisions leadership needs the assessment to support.
-
Assess exposure and control evidence
Review the technical stack, policy landscape, compliance gaps, and material scenarios. Theodolite accelerates evidence organization and risk-surface mapping.
-
Prioritize and brief leadership
Deliver the technical findings, business-impact roadmap, and board-ready executive summary with owners, sequencing, and clear next decisions.
Who This Is For
Built for organizations making consequential security decisions from fragmented evidence.
-
Growth-Stage Companies
Turn fragmented scans, questionnaires, audit findings, and customer demands into one defensible sequence of work.
-
Boards and Executives
Get a decision-ready view of business exposure, concentration, resilience, and investment priorities.
-
PE and VC Portfolio Companies
Translate inherited security debt into a practical post-close or pre-exit roadmap.
-
Regulated Operators
Connect technical and policy evidence to the governance, resilience, and compliance decisions leadership must make.
Leadership You Can Trust
Most advisors diagnose. Operators prescribe.
vCSO.ai is led by Nick Shevelyov, former Chief Security Officer of Silicon Valley Bank and author of Cyber War and Peace. The assessment method connects technical depth with the governance altitude boards and executives need.
Achievements
- Defended Silicon Valley Bank’s cyber posture for 15 years (2007-2021), through every major crisis from the 2008 financial collapse to SolarWinds.
- Design partner and advisor to category-defining cybersecurity companies including Palo Alto Networks, Zscaler, CrowdStrike, FireEye, and Eclypsium.
- Forbes Technology Council member, NASDAQ board director (AuthID), author of Cyber War…and Peace.
- Founder of the CISO Supper Club, convening Bay Area cybersecurity executives twice a year.
Who You’ll Work With
Led by experienced operators and supported by assessment, compliance, and technical specialists. The work stays connected from evidence through executive decision.
Andrej
CISSP, ethical hacker (assessments and pen testing)
Berk
GRC specialist (compliance frameworks)
Nicholas
Operations and Website
Sonija
Operations and Accounting
Trusted by security leaders
What CISOs, founders, and risk leaders say about working with Nick.
“Nick has been an invaluable partner in elevating Audubon's cybersecurity strategy. His ability to provide clear, level-headed advice has been instrumental during tough moments, and his executive-level communication skills have been particularly effective for the org to plan for right-sized investments in cybersecurity.”
CTO, National Audubon Society
“Nick and team have been amazing partners to Pixee. Their knowledge, relationships, and industry experience have been a core part of our go-to-market strategy and refinement.”
Surag PatelCEO, Pixee
“Nick and team provide a unique value blending cultural enablement and a risk-focused cyber risk management strategy. Their approach helped our team rapidly improve the effectiveness of our cyber risk program with quantifiable results.”
Alexander TraftonSVP Technology Risk and Compliance, G42
FAQ
Questions about cyber risk assessment services.
How long does a cyber risk assessment take?
Sprint A is a focused 30-day posture review. It examines the technical stack, policy landscape, and compliance gaps, then turns the evidence into a technical report, board-ready executive summary, and prioritized remediation roadmap.
What is included in the assessment?
Deliverables include a technical assessment report, Theodolite-generated risk surface map, policy and compliance gap analysis, prioritized remediation roadmap with business-impact scoring, and board-ready executive summary.
Is a cyber risk assessment the same as a vulnerability scan?
No. A scan identifies technical conditions. A cyber risk assessment connects technical evidence with critical services, business consequences, current controls, ownership, and treatment decisions.
Is this the same as a penetration test or audit?
No. A penetration test evaluates whether defined attack paths can be exploited, while an audit tests evidence against stated criteria. A risk assessment can use both as evidence, but its purpose is to help leadership prioritize exposure and action.
Can the findings be presented to our board?
The engagement includes a board-ready executive summary designed to explain exposure, movement, accountability, and decisions at the appropriate governance altitude.
What happens after Sprint A?
The roadmap defines the next sequence of work. When ongoing leadership is needed, Strategic Oversight can continue with program direction, incident readiness, implementation governance, and quarterly board reporting.
What should you do first, and why?
The assessment gives leadership a clear view of exposure, a roadmap the team can execute, and an executive summary the board can govern from. When ongoing leadership is needed, Strategic Oversight carries the work forward.
