Most organizations don't need a full-time CISO yet — but they need someone senior thinking about security continuously, not just when there's a crisis. Ongoing support is a retained relationship: a senior CyberBullet practitioner embedded in your security cadence.
What is Ongoing Cybersecurity Support?
Ongoing cybersecurity support is a retained advisory relationship — a senior CyberBullet practitioner embedded in your security operations cadence, providing continuous oversight without a full-time hire.
It’s the answer to a common problem: most organizations don’t need (or can’t afford) a full-time CISO, but they need someone senior thinking about security continuously rather than only during the annual penetration test or audit week.
Why a retainer beats project-by-project work
Project-by-project security work has a structural problem: the consultant walks in cold every time, spends days re-learning your environment, makes recommendations based on partial context, and walks away with no visibility into whether the work landed.
A retained relationship inverts that. The same senior practitioner:
- Understands your environment over time — recommendations get smarter as context deepens
- Catches issues before they become projects — a 30-minute call about a new vendor often prevents a six-month remediation
- Maintains continuity across initiatives — security work doesn’t reset every time priorities shift
- Sees patterns — recurring issues, drifting controls, gaps that open up as the business evolves
- Builds institutional knowledge — the kind that walks out the door with each rotating consultant
The economics work out: 4-12 hours per month of senior advisory typically costs less than the time your team would otherwise spend learning, researching, and second-guessing security decisions.
What an Ongoing Support engagement looks like
Monthly Operations Review
A 60-90 minute call covering: any incidents or near-misses, vulnerability posture trends, in-flight remediation status, upcoming security work, and any open questions from your team. The call has an agenda; you leave with documented action items.
Quarterly Strategic Review
A deeper session covering security program maturity, control posture trends, upcoming compliance milestones, and the strategic security investments to consider in the next quarter. Includes an executive- ready summary suitable for leadership or board reporting.
Ad-Hoc Consultations
Direct access to a senior practitioner via dedicated channel for the questions that come up between scheduled reviews. Typical asks: vendor security reviews, architecture decisions, incident triage, audit response, employee questions about specific scenarios.
Annual Pentest
One full penetration test per year is included in the standard retainer — scoped to the most valuable engagement for your environment that year. Additional pentests, assessments, or specialized engagements are available at retainer pricing.
Compliance Posture Maintenance
Continuous monitoring of your compliance posture against applicable regulations. We track control drift, evidence freshness, and emerging regulatory changes that affect your obligations — flagging issues before they become audit findings.
What you get vs. what you don’t
Included: Strategic advisory, ad-hoc consultations, monthly and quarterly reviews, annual pentest, compliance posture monitoring, incident triage (first 4-6 hours), policy and procedure templates.
Not included: Hands-on operational security work (we don’t run your SOC), full incident response engagements (separate scope), specialized engagements outside the annual pentest (additional cost at retainer rates), formal CISO role on your org chart (that’s a vCISO engagement).
Who this is for
- Mid-market organizations with formal security needs but no full-time CISO budget
- Companies whose CISO recently departed and need bridge coverage while recruiting a replacement
- Growing startups scaling past the point where founders can handle security personally
- Organizations with a security person who needs senior backup for strategic decisions
- Companies using multiple vendors today who want consolidated advisory through one relationship
Our methodology
Every engagement runs through the same six phases. Manual validation isn't a finishing step — it's the product.
Scope & Authorize
We define the engagement boundary precisely before testing starts — in-scope assets, out-of-bounds targets, testing windows, and emergency-stop procedures.
- Written authorization letters exchanged before any packet leaves our infrastructure
- Signal / Slack channel established for real-time findings during the engagement
- Explicit rules of engagement reviewed with legal, IT, and business stakeholders
Passive Reconnaissance
Before a single packet touches your infrastructure, we map your external footprint using public sources only — DNS, CT logs, code repos, internet-wide scan data.
- Typically discovers 15-30% more attack surface than the client originally provided
- Certificate transparency, BGP, and GitHub exposure reporting
- OSINT profile for social engineering vectors if in scope
Active Discovery
We enumerate live services across in-scope assets — ports, software versions, auth mechanisms, and protocol configurations — correlated against current vuln data.
- Hand-tuned scanning profiles — not the default Nessus run
- Protocol-level inspection for TLS, SSH, SMB, Kerberos, LDAP
- Service fingerprinting to ground truth before any exploitation
Manual Validation
Every potential issue is validated by hand before it makes the report. No CVE-dumping. No false positives. This is what separates the engagement from a scan.
- Manual exploitation attempts for any finding of High severity or above
- Business-logic testing on top of the technical layer
- Chained vulnerabilities analyzed as a single attack path
Exploitation & Impact
For confirmed vulnerabilities with attacker value, we attempt exploitation to prove impact — not just that a CVE applies, but what it gets you.
- Proof-of-exploit captured for every confirmed critical finding
- Pivot paths mapped to the actual crown-jewel data
- Interim notification inside 24 hours for anything critical
Report & Remediate
Every finding is paired with severity rated on real exploitability, reproducible proof-of-exploit, and remediation guidance your team can ship this sprint.
- Executive summary and technical deep-dive in a single report
- Findings mapped to CIS, NIST CSF, and relevant compliance families
- Retest included — we confirm the fix before we close the finding
What you walk away with
Frameworks we map to
Findings ship mapped to the control families your regulators and auditors actually check. Governance clients use these crosswalks directly in their program documentation.
- CIS Controls v8
- NIST CSF 2.0 / 800-53
- PCI DSS 4.0
- HIPAA Security Rule
- SOC 2 Type II
- OWASP ASVS
Questions we get asked
How is this different from hiring a Virtual CISO?
vCISO is a more involved engagement — typically 4-8 hours per week of executive-level security leadership, often filling the formal CISO role on the org chart. Ongoing Support is lighter — 4-8 hours per month of senior advisory, primarily reactive (you ask, we answer) with proactive reviews quarterly. Many clients start with Ongoing Support and graduate to vCISO as their needs grow.
What's the typical retainer commitment?
12-month engagements with quarterly review checkpoints. Most clients renew annually — the relationship value compounds over time as we get deeper context on your environment. Pricing scales with hours allocation; most clients land in the 4-12 hours/month range. Specific quotes provided after a scoping call.
Who handles things between scheduled reviews?
You do — but you have direct access to a senior practitioner via dedicated Slack or Signal channel for ad-hoc questions during business hours. Typical use: 'we're evaluating this vendor — what should we be checking?' or 'we just discovered this in our environment — is it a problem?' or 'our auditor is asking about X — how should we respond?' Quick answers, not full engagements.
Does this include incident response?
Triage and advisory yes; full IR engagement no — that's a separate scope. If you suspect an active incident, we'll help you assess severity, recommend immediate containment steps, and connect you to a full IR engagement if warranted. The retainer covers the first 4-6 hours of incident triage; deeper response is scoped separately at retainer rates.
Do we own the deliverables we generate together?
Yes — every artifact created during the engagement (policies, assessments, reports, runbooks) is yours. We retain no proprietary IP from the relationship. The only thing we keep is the relationship knowledge, which informs better recommendations over time.