What is Security on Call?
Security on Call is a monthly retainer for the security questions that arrive without warning. You send them to a senior consultant who already knows your environment, and every request is tracked against an agreed response target.
Most security questions do not arrive as projects. They arrive as an email someone is unsure about, a questionnaire due Friday, or a tool a department already started using. Handling those one at a time through a quote and a statement of work costs more in overhead than the work itself.
Security on Call keeps the line open. You retain a block of hours each month and send us what comes up. Every request is logged, given a response time target based on its priority, and tracked against that target rather than answered whenever we get to it.
Because the same consultant works your account month after month, you are not re-explaining your environment each time. That is most of what makes the model worth it.
At the end of each month you get a report covering every request, the hours used against the hours retained, how we performed against the response targets, and what we suggest doing next. It is written to be readable by your leadership and useful to an auditor or an insurer who asks how security questions get handled.
Who needs it?
- A business that gets regular security questions but has no one in-house to answer them
- A company that keeps receiving vendor security questionnaires
- A team adopting new tools and wanting a quick security view first
- An organization that wants a record of how security questions are handled
What problems does it address?
- A suspicious email and nobody sure whether to open it
- A security questionnaire due Friday
- A department that already started using a new tool
- Small questions that cost more in quotes and paperwork than the answer itself
What you can send
- Suspicious emails that need a second opinion
- Vendor security questionnaires to complete or review
- New systems and tools to assess before you adopt them
- Cyber insurance questions and renewal evidence
- Control questions when you are unsure what good looks like
- Anything else security related that does not fit a project
How it works
- A fixed monthly fee for a set number of hours, agreed up front
- Every request logged as a ticket with a response time target
- Urgent, normal and low priorities, each with its own clock
- Business hours response, tracked against the target rather than promised loosely
- Unused hours roll over to the next month
- Extra hours only with your approval, at the same rate
- Hours used and any extra hours reported every month, so there are no surprises
What you receive each month
- A monthly report showing every request and how it was handled
- Hours used against hours retained, with a burndown
- Response time performance against the agreed targets
- Recommended next steps drawn from the month's activity
- A running record you can hand to an auditor or an insurer
What happens afterward?
The work continues on the scope and cadence you agreed. Findings that need fixing can move to Remediation Guidance & Retesting, and a fresh assessment can check progress.
How the engagement works
Free consultation
A 45-minute call with a senior consultant about your situation. It is a conversation, not an assessment. You leave with a recommended next step.
Agree the scope
What we cover, how often and how much time, agreed in writing up front.
Ongoing work
The same senior consultant works with you each time, so you are not re-explaining your environment.
Reporting
Regular reporting written for leadership, and useful to an auditor or insurer who asks how security is handled.
