Virtual & fractional CISO
Accountable security leadership on a monthly retainer, sized to what your business actually needs.
- Board and investor reporting
- Risk ownership and roadmap
- Customer assurance and audits
Virtual & fractional CISO
Grow fast without outgrowing your security.
Building product first is the right call. The catch is that the early decisions your engineering and IT teams make quietly shape how agile, resilient and certifiable the business will be later. Bring the security voice into the room early, and those same decisions start accelerating your growth rather than constraining your next audit, investor review or enterprise deal.
Why security gets expensive later
Most scale-ups hire IT before they hire security. That is the right call.
The problem is what happens next.
The decisions your IT function makes in its first two years quietly determine what your first certification will cost and how long your first enterprise security review will take.
How identity is architected. How devices and access are provisioned, and revoked. Which suppliers touch customer data, and what was actually agreed with them. What gets logged, and for how long.
None of these are security decisions when they are made. They only become security decisions later, when somebody asks for evidence.
Three decisions we see again and again. All sensible at the time. All made by competent people.
DecidedBuy a standalone endpoint security product.
Found out laterEquivalent protection was already included in licensing it owned, alongside two controls it had been separately quoted to buy.
DecidedDeploy it, and leave the default configuration alone.
Found out laterThe detection features it was paying for had never been switched on, leaving it blind to targeted intrusion.
DecidedLet teams use AI tools wherever they helped.
Found out laterCustomer data had been pasted into tools nobody had assessed, under terms nobody had read, and there was no record of what had gone where.
There was never a moment when this business chose to defer security. There was simply no one in the room translating its operational decisions into assurance consequences. That translation is the whole of what we do.
Case study
The security you are already paying for.
A UK multi-site consumer business asked a procurement question: should we renew our endpoint security subscription? The answer took ten minutes. What surfaced while checking took the rest of the engagement.
01
Duplicate spend
A premium subscription paid annually, while equivalent protection sat unused inside enterprise licensing the business already owned, alongside privileged access controls and data loss prevention it had been separately quoted to buy.
02
Detection switched off
The product it was already paying for ran with only basic anti-virus enabled. The features that detect a genuine intruder were licensed, paid for, and disabled. No decision, no risk acceptance, just a default nobody revisited.
Competent IT. A working estate. And still a gap, because nobody owned the translation between what operations does and what assurance requires. The findings went to the board as a four-page pre-read.
Neither of these was a tooling failure
Two ordinary operational decisions, made competently, for sensible reasons. Both had assurance consequences nobody was tracking. One saved money once found, the other cost nothing to fix.
The engagement arc
Assess, prioritise, lead, assure.
Most engagements start small and deliberately. We land on a fixed-fee piece of work with a board-visible output, then take ownership of what it recommends.
01 · Assess
Find the gap
Two to three weeks, fixed fee. We map your estate, suppliers and configuration against what the business has committed to over the next eighteen months: the customers you intend to win, the round you intend to raise, the renewal you need to pass, the certification somebody is already asking for.
02 · Prioritise
Sequence the work
A named, costed set of gaps in the order they should be closed, with the exposure quantified. Written for a board, not for engineers.
03 · Lead
Own the roadmap
We take accountability for delivery: your risk register, your policy set, your auditor and customer conversations, your board reporting.
04 · Assure
Prove it holds
Deals unblocked, questionnaires answered in days rather than weeks, certification achieved and maintained, diligence survived without a scramble.
Typical first engagement
An IT and Assurance Alignment Review. Two to three weeks, fixed fee, delivered as a board-ready paper. Most clients move to a retainer at the end of it, because the roadmap needs an owner.
Governance · Risk · Assurance
Four things we own, so you do not have to hire for them.
Every engagement is a named, scoped piece of work with defined deliverables. No open-ended consulting, no day-rate drift.
Governance, risk & assurance
The function itself: frameworks, registers, policy architecture and the evidence to back them.
- Risk framework and register
- Policy architecture
- Security operating model
Certification readiness
Certification treated as a commercial deadline, because that is usually what it is.
- ISO 27001 and SOC 2
- Cyber Essentials and Plus
- PCI DSS v4.0 and UK GDPR
Supply chain assurance
Your suppliers hold your data and your obligations. Most assurance programmes cannot prove it.
- Third-party risk framework
- Supplier tiering and assessment
- Contractual and audit evidence
AI governance and assurance
Your people are already using AI. The question is whether you can say which tools, on what data, under whose terms, and who approved it. Customers are starting to ask that question in the same breath as everything else, and the answer is becoming a condition of the deal well before it becomes a condition of any certificate.
What we do
- Shadow AI discovery and tool inventory
- Acceptable use, approval routes and named accountability
- Vendor terms, data flows and DPIAs
- ISO 42001 and NIST AI RMF alignment, mapped to your existing ISO 27001 work
What already applies
- UK GDPR duties on automated decision-making and DPIAs, enforced by the ICO
- EU AI Act transparency obligations, in force since August 2026, which reach UK businesses whose AI touches the EU market
- Enterprise customers asking how you govern AI, in the same questionnaire as everything else
What is coming
- December 2026: further EU transparency duties and new prohibited practices
- December 2027 and August 2028: EU high-risk obligations, deferred but not withdrawn
- A UK code of practice on AI and automated decision-making
Retainers
Published pricing, because you should not need a call to find out.
Retainers are sized by monthly days, not by headcount you are replacing. Projects are scoped and quoted individually.
Board-level security leadership, without the full-time hire. A named, accountable security leader on a monthly retainer, sized by the days your business actually needs, not a permanent headcount you are not ready to carry.
Strategic Oversight
From £3,500per month 2-3 days per month- Quarterly board & exec reporting.
- Risk register design & maintenance.
- Customer questionnaire support.
- Named CISO escalation.
- AI governance.
Roadmap Ownership
From £8,000per month 5-6 days per month- Includes everything in Strategic Oversight.
- End-to-end roadmap delivery.
- Certification programme leadership.
- Active vendor & auditor management.
- Policy & control architecture.
- AI governance.
Fractional Executive
From £15,000per month 10-12 days per month- Includes everything in Roadmap Ownership.
- Investor & M&A diligence representation.
- Regulatory compliance alignment.
- Incident readiness & crisis management.
- Embedded leadership presence.
- AI governance.
See the full tier comparison and service descriptions
Customised scope, transparent pricing
The tiers above serve as baseline models for typical maturity stages. Deliverables, day allocations, and focus areas are fully tailored to your operational requirements identified during our initial alignment call—ensuring you only pay for the exact security leadership your business needs.
About Annansec
A small crew, working the frontier the large firms find hard to reach.
Annansec exists because the organisations that most need security leadership are usually the ones least able to justify a full-time hire. They are growing quickly, selling into buyers who ask hard questions, and running on a technology estate assembled faster than it was governed.
We are deliberately small. That is the point: you get the person who did the work, not a team assembled around a proposal.
Where the experience comes from
- Director of Security, global consumer platform
- Head of Cyber Oversight, FTSE insurer
- Head of Security Architecture and Design
- Principal Consultant and QSA, cyber consultancy
How we work
- Fixed scope, fixed fee, written change control
- Board-legible output as standard
- We refer the work we should not do
- Contributor to national cyber working groups
Start here
Twenty minutes, and no pitch.
Tell us what is blocked, who is asking, and when they need an answer. If we are not the right people, we will say so and point you to who is.
Conversations are confidential. We do not need your data to have the first one.