vCISO Lite

vCISO Lite is a United States-based compliance and cyber risk platform aimed at small and mid-sized companies that do not have an in-house Chief Information Security Officer. Its own positioning is explicit: it is "the compliance and cyber risk platform for growing companies," built to remove security as an obstacle to solving business problems rather than to add another dashboard for security specialists. The product bundles automated compliance work — SOC 2, ISO 27001 and HIPAA readiness, policy generation, evidence collection and security questionnaire response — with human advisory services delivered under the Other20 brand. The platform is organized around a set of functional modules that the company abbreviates on its homepage: Business Controls, Technical Controls, Enforcement, Reporting, Vendor Risk, Due Diligence, Cyber Maturity, Audit Prep, Configuration Management, Remediation, Red Team and Quantify Risk. Together these cover the operational loop the company describes as assess, quantify, build, prove, report and validate. A newer addition, The Operating Plan, is presented as a budgeting and board-communication tool that shows which security programs make the funding cut, what each dollar buys in reduced expected loss, and what risk is being accepted on the record. vCISO Lite sells to companies that are being pushed by external parties rather than by an internal security mandate. Its homepage frames four common entry points: closing a deal when a 200-question security questionnaire arrives, impressing investors during due diligence, getting ahead of client and partner security questions, and passing an audit without a last-minute fire drill. The company cites research that 54% of companies lose deals to security questionnaires and that each questionnaire takes ten to forty hours to complete manually, arguing that security has become a sales-motion problem rather than a due-diligence afterthought. Pricing is deliberately low-friction. The homepage advertises fractional CISO and vCISO services from $299 per month, while the services page lists vCISO engagements from $1,750 and third-party risk questionnaire completion from $1,750 priced by length and complexity. The services arm, branded Other20, is built on the premise that software can handle roughly 80% of security operations work — policy generation, evidence collection, questionnaire responses — while the remaining 20% requires humans for strategic advice, risk assessments, audit relationships, M&A risk pricing and board communication. Other20 is presented not as a replacement for vCISO Lite but as its complement. The company also markets an AI red team capability called the Red Claw, which runs on-demand adversarial testing against applications and APIs and produces findings, severity ratings, attack chains and remediation guidance. vCISO Lite reports more than 100 assessments supported, a 96% first-assessment control verification rate, an average of three weeks to audit readiness, and $300K+ saved versus a full-time hire. It is a privately held company; no parent, owner or stock listing is disclosed in the available evidence.

vCISO Lite was created to serve a specific gap in the security market: small and mid-sized companies that face enterprise-grade security expectations but cannot justify a full-time Chief Information Security Officer. The company's own about page states the motivation plainly — it was built to remove security as an obstacle to solving business problems, not to add another dashboard for security people to admire. It describes itself as "what a working CISO builds when she's tired of watching small companies get shut out of the fundamentals enterprises take for granted," and says it is priced so that a thirty-person company can operate it from day one. The market context the company cites is the steady rise of third-party security requirements. Enterprise buyers now expect every vendor, regardless of size, to demonstrate the same security posture a Fortune 500 supplier would: compliance frameworks, third-party risk assessments, quantified cyber exposure and board-ready reporting. Enforcement has moved earlier in the sales cycle, with procurement pricing security in at contract negotiation rather than waiting for an incident. vCISO Lite cites research that 54% of companies lose deals to security questionnaires, that each questionnaire takes ten to forty hours to complete manually, and that 86% of B2B purchases stall somewhere in the buying cycle, with a late security review being one of the most reliable stall points. The product was built as a platform rather than a point tool. Its functional modules — Business Controls, Technical Controls, Enforcement, Reporting, Vendor Risk, Due Diligence, Cyber Maturity, Audit Prep, Configuration Management, Remediation, Red Team and Quantify Risk — map to a six-stage operating loop the company calls assess, quantify, build, prove, report and validate. The company stresses that this is a loop rather than a launch: teams do not "finish" security but run the cycle again as their stack, risk and customers change, and skipping a stage surfaces gaps downstream. A human services arm, branded Other20, was added to complement the software. Its premise is that software can handle about 80% of security operations work — policy generation, evidence collection, questionnaire responses — while the other 20% requires experienced professionals for strategic advice, risk assessments, audit relationships, pricing cyber risk in M&A deals, explaining SOC 2 to a board, and negotiating with enterprise prospects. Other20 offers service packages including third-party risk questionnaire completion from $1,750, priced by length and complexity, with full questionnaire completion for frameworks such as CAIQ and SIG, evidence package assembly, internal follow-up until gaps are closed, buyer security team Q&A handling, and a reusable answer library. More recently the company introduced The Operating Plan, a budgeting and board-communication capability. It lets a team set the budget it actually has, shows which programs make the funding cut, what each dollar buys in reduced expected loss, and what risk is being accepted on the record by declining a program, with a board slide generated automatically. The company also markets the Red Claw, an AI red team that runs on-demand adversarial testing against applications and APIs and produces findings, severity ratings, attack chains and remediation guidance — positioned as well past a scan but not a replacement for a third-party penetration test where compliance requires one. vCISO Lite reports more than 100 assessments supported, a 96% control verification rate on first assessment, an average of three weeks to audit readiness, and $300K+ saved versus a full-time hire. It is privately held, and the available evidence does not disclose a parent company, owner, founder or founding year.

• vCISO Lite platform launched as a compliance and cyber risk platform for growing companies without an in-house CISO.

• Other20 fractional CISO and vCISO services introduced, with vCISO engagements from $1,750 and third-party risk questionnaires from $1,750.

• The Operating Plan launched, adding security budgeting and board-slide generation to the platform.

• Red Claw AI red team capability introduced for on-demand adversarial testing of apps and APIs.

Compliance, risk quantification, diligence and experienced security leadership priced for growing companies without an in-house CISO; software handles roughly 80% of the work while Other20 experts handle the remaining 20%.

• vCISO Lite platform

  Compliance and cyber risk platform covering business controls, technical controls, enforcement, reporting, vendor risk, due diligence, cyber maturity, audit prep, configuration management, remediation, red team and risk quantification.

• Other20 services

  Human advisory arm providing fractional CISO and vCISO services, board presentations, auditor relationships, risk assessments, vendor negotiations, security strategy and compliance guidance.

• Third-Party Risk Questionnaires

  Service that completes security questionnaires such as CAIQ and SIG, assembles evidence packages, follows up internally until gaps are closed, handles buyer security team Q&A and builds a reusable answer library. From $1,750 priced by length and complexity.

• The Operating Plan

  Budgeting and board-communication tool that shows which security programs make the funding cut, what each dollar buys in reduced expected loss, and what risk is accepted on the record, with a board slide generated automatically.

• Red Claw

  AI red team that runs on-demand adversarial testing against applications and APIs, producing findings, severity ratings, attack chains and remediation guidance.

1. 1vCISO Lite: Fractional CISO & vCISO Services from $299/movcisolite.com
2. 2About | vCISO Lite — Compliance and cyber risk platform for growing companiesvcisolite.com
3. 3vCISO Services from $1,750: Audit Prep, Fractional CISO, Diligence | vCISO Litevcisolite.com
4. 4How to Build a Cybersecurity Program (Not a Binder) | vCISO Litevcisolite.com
5. 5vCISO Litewikidata.org