Strategic Advisory Oversight
Executive Security Leadership for the Innovation Economy.
Fractional CSO advisory without the full-time cost — board reporting, program oversight, and incident readiness, accelerated by Theodolite.
-
15 years as CSO at Silicon Valley Bank, the bank of the innovation economy
-
$200B+ in assets defended at enterprise scale
-
Design partner to Palo Alto Networks, Zscaler, CrowdStrike, FireEye, and Eclypsium
-
Author of Cyber War and Peace; board member, Bay Area CSO Council
-
Trusted advisor to PE/VC firms, cyber product companies, and enterprise boards
-
15 years as CSO at Silicon Valley Bank, the bank of the innovation economy
-
$200B+ in assets defended at enterprise scale
-
Design partner to Palo Alto Networks, Zscaler, CrowdStrike, FireEye, and Eclypsium
-
Author of Cyber War and Peace; board member, Bay Area CSO Council
-
Trusted advisor to PE/VC firms, cyber product companies, and enterprise boards
-
15 years as CSO at Silicon Valley Bank, the bank of the innovation economy
-
$200B+ in assets defended at enterprise scale
-
Design partner to Palo Alto Networks, Zscaler, CrowdStrike, FireEye, and Eclypsium
-
Author of Cyber War and Peace; board member, Bay Area CSO Council
-
Trusted advisor to PE/VC firms, cyber product companies, and enterprise boards
What’s Included
Program leadership your team can execute against. Board reporting your directors will trust. Incident readiness when it matters. Theodolite-accelerated throughout.
Lead the security program
Governance, architecture, and program direction an enterprise board expects — without a full-time headcount.
Report to your board
Risk translated into business outcomes. Quarterly updates, material-event briefings, audit-ready communication.
Run incident readiness
Tabletop exercises, incident response plans, and hands-on leadership when a real event starts unfolding at 2 AM.
Bring in specialists on demand
Pen testers, compliance auditors, forensics teams, SOC analysts. When the work needs specialized capability, we bring in the right partner and manage it.
Typical program: 5–20 hrs/month on retained cadence, starting with a 30-day Sprint A assessment.
The Proprietary Differentiator
Powered by Theodolite™
Theodolite is our proprietary AI security intelligence platform. It compresses the posture review, policy and compliance analysis, and risk-surface mapping that typically take consultant teams weeks — giving you a financial understanding of your value at risk, delivered at senior-practitioner quality and machine speed.
Every Strategic Advisory engagement is Theodolite-accelerated. Sprint A, quarterly board reporting, and incident-readiness diagnostics all lean on the platform to surface risk fast — and on our senior advisors to turn findings into board-ready strategy.
Learn more about Theodolite →How It Works
-
Sprint A — 30-Day Assessment
Fast-start entry point. Theodolite-accelerated posture review across your technical stack, policy landscape, and compliance gaps, delivered as a technical report and a board-ready executive summary.
-
Fractional CSO Oversight
Ongoing executive-level guidance on a retained cadence. Program direction, vendor evaluation, incident governance, and quarterly board reporting — woven together by a single relationship, not a rotating bench.
-
Scale, Transition, or Exit
Whether you mature to a full-time CSO hire, prepare for acquisition, or navigate a regulatory event — we structure the next step and hand off cleanly when the time comes.
Who This Is For
Built for companies where security posture materially shapes the deal — the board meeting, the audit, the acquisition, the Series C.
-
Growth-Stage Companies
Series B through IPO-bound. Your customers and board expect enterprise security posture — you need leadership without a million-dollar commitment.
-
Post-Acquisition Portfolio
PE / VC portfolio companies with inherited security debt. We stabilize the program and integrate cleanly with the sponsor’s operating model.
-
Pre-Exit Enterprises
Getting ready for M&A or regulatory scrutiny. We close the posture gaps that would show up in due diligence — before they become deal terms.
-
Regulated Operators
Financial services, healthcare, fintech, critical infrastructure. Where compliance isn’t a checkbox and a named, experienced advisor is required by design.
Leadership You Can Trust
Most advisors diagnose. Operators prescribe.
vCSO.ai is led by Nick Shevelyov — 15-year Chief Security Officer at Silicon Valley Bank, the bank of the innovation economy. Design partner to Palo Alto Networks, Zscaler, CrowdStrike, FireEye, and Eclypsium. Author of Cyber War and Peace. Board member, Bay Area CSO Council.
Achievements
- Defended Silicon Valley Bank’s cyber posture for 15 years (2007-2021), through every major crisis from the 2008 financial collapse to SolarWinds.
- Design partner and advisor to category-defining cybersecurity companies including Palo Alto Networks, Zscaler, CrowdStrike, FireEye, and Eclypsium.
- Forbes Technology Council member, NASDAQ board director (AuthID), author of Cyber War…and Peace.
- Founder of the CISO Supper Club, convening Bay Area cybersecurity executives twice a year.
Who You’ll Work With
Led by Nick, supported by specialists in assessment, compliance, and operations. You get a team of operators — not handed off to a junior consultant.
Andrej
CISSP, ethical hacker (assessments and pen testing)
Berk
GRC specialist (compliance frameworks)
Nicholas
Operations and Website
Sonija
Operations and Accounting
FAQ
Questions boards ask before signing.
How is this different from hiring a consultant?
Consultants deliver a report and leave. Strategic Advisory Oversight is a retained advisory relationship — we stay through implementation, evolve strategy as you grow, and carry institutional knowledge you’d otherwise lose each time. (Background: what is a fractional CISO.)
What’s the time commitment?
Typically 5–20 hours per month on an ongoing basis. Sprint A compresses 30 days of intensive assessment up front; from there we scale cadence to the program’s needs. (More on what fractional CISOs cost by stage and scope.)
Do you work with our existing team or replace them?
We work with your existing security, IT, and engineering teams and provide the executive-level direction they need. We augment leadership capacity — we don’t replace line staff.
What if we need specialized capabilities beyond advisory?
Our network spans pen testers, compliance auditors, forensics teams, and virtual SOCs. If it’s not in-house we bring in the right partner — and we manage the work so you don’t have to.
Can we transition to a full-time CSO later?
Yes — and that’s often the outcome we plan for. When you’re ready, we help with the search and the onboarding handoff. Who’s better qualified to hire a CSO than a CSO who’s been in the chair? (See how to choose a fractional CISO for evaluation criteria.)
Ready to see what a 30-day assessment surfaces?
Sprint A compresses 30 days of intensive Theodolite-accelerated posture review into a technical report and a board-ready executive summary. From there, we scale cadence to the program’s needs.
