What is a Virtual Security Architect?
A Virtual Security Architect is independent, senior security architecture expertise for your projects and technology decisions. It works alongside your existing IT provider rather than replacing them.
Your IT provider keeps your systems running. That is a different job from deciding how those systems should be designed to resist attack. Most small businesses have the first and not the second.
A Virtual Security Architect fills that gap. We work alongside your IT provider, not in place of them. They keep running the environment. We advise on how it should be built, review what is proposed and make sure security is part of the decision before it is expensive to change.
This is project and technology focused. If what you need is a security program, governance and reporting to leadership, that is vCISO. Some clients use both.
Who needs it?
- A business with an MSP or small IT team and no security specialist
- A company planning a migration, a new office or a major system change
- An organization that cannot justify a full-time security architect
- A team that wants independent review of what its IT provider proposes
What problems does it address?
- Technology decisions made without anyone asking how they affect security
- Security added after a project is built, when it is expensive to change
- IT provider proposals with no independent review
- No one to ask before choosing a vendor or a new system
What we do
- Security architecture for new systems and changes
- Reviews of technology before you buy or deploy
- Vendor and product selection from a security point of view
- Cloud and SaaS security
- Network architecture
- Identity architecture
- Security requirements for projects and contracts
- Risk assessments tied to specific decisions
- Project and design reviews
- Incident preparedness
What you receive
- Written design guidance your IT provider can build from
- Reviews and recommendations at the point decisions are made
- Security requirements to hand to vendors and project teams
- A regular working session on a schedule you set
- A record of decisions and the reasons behind them
What happens afterward?
The work continues on the scope and cadence you agreed. Findings that need fixing can move to Remediation Guidance & Retesting, and a fresh assessment can check progress.
How the engagement works
Free consultation
A 45-minute call with a senior consultant about your situation. It is a conversation, not an assessment. You leave with a recommended next step.
Agree the scope
What we cover, how often and how much time, agreed in writing up front.
Ongoing work
The same senior consultant works with you each time, so you are not re-explaining your environment.
Reporting
Regular reporting written for leadership, and useful to an auditor or insurer who asks how security is handled.
