Kurosec services
Fractional security leadership
Give your business experienced security direction through an ongoing commitment that fits your needs.
Who it helps
Keep security decisions moving.
For business leaders who need senior security input without the cost or commitment of a full-time executive hire, and teams that need ongoing direction.
- Security needs a clear direction, but a full-time leadership role is not the right fit.
- Your team needs support setting priorities and explaining risk to business leaders.
- Security work is growing and needs consistent governance, ownership and follow-through.
What you receive
Useful work, with a clear purpose.
The deliverables are agreed around your needs. Depending on the scope, the work can include:
A direction suited to the business
Security priorities and a programme roadmap shaped around business needs, risks and the capacity of your team.
Support for leadership decisions
Clear explanations of risks, options and trade-offs so leaders can make informed decisions and assign ownership.
Governance and accountability
Agreed ways to review priorities, track actions and escalate decisions, with clear responsibilities across the business.
Ongoing programme guidance
Consistent direction for your security work, including policies, assurance and programme development within the agreed remit.
How we work
A clear scope and practical next steps.
Agree the remit
Discuss the business context, current responsibilities and decisions that need support. Agree the scope, commitment and ways of working.
Set the priorities
Establish a shared view of the programme and a practical set of priorities, with named owners and clear decision routes.
Review and adapt
Provide ongoing direction, review progress and adjust priorities as the business and its security needs change.
Common questions
Before you begin.
Is fractional security leadership the same as a vCISO?
This type of support is often called a fractional CISO or virtual CISO (vCISO): a part-time Chief Information Security Officer. At Kurosec, the agreed remit can include setting priorities, advising business leaders and guiding your security programme.
Can you work with our existing security or technology team?
Yes. The arrangement should complement your existing team. Responsibilities, decision-making authority and the work your team will carry out are agreed at the outset.
How much time would we need?
The commitment depends on your starting point, priorities and the support already available in your organisation. It is agreed as part of the engagement and can be reviewed as your needs change.
How is this different from a security review or project?
A review provides findings and recommendations. A project puts a defined capability in place. Fractional leadership provides continuing direction and support for decisions across your agreed security remit.
Your consultant
Independent security experience.
Kurosec is Haroon Mahmood's independent information security consultancy. Haroon brings more than 25 years of experience, including senior roles at Sun Microsystems, Oracle and Salesforce.
From Haroon's previous in-house work: Giving a business its first security function.
About Haroon Mahmood