Independent virtual CISO and security strategy for New Zealand and Australian business. We own the strategy, set the priorities, hold your providers to account, and give your board a straight answer on where you stand.
Book a strategy conversation →At some point a business becomes too big to leave security to whoever has time for it, and still too small to justify a full-time Chief Information Security Officer on a senior executive salary. The symptoms are consistent. The board asks how exposed you are and nobody can answer with evidence. Your IT provider recommends the next purchase and you have no way to judge whether it is the right one. Security work happens in bursts, usually after a client questionnaire or a near miss.
The missing piece is rarely technology. It is someone accountable for deciding what matters, in what order, and for how much.
A virtual CISO is senior security leadership bought by the day rather than by the salary. The role is governance, not configuration: owning the security strategy, setting priorities against real risk, translating that risk into language a board and an insurer understand, and holding internal teams and external vendors to account for delivery.
It is deliberately not a technical role. We do not administer your systems or operate your tooling. We establish what good looks like, make sure the right work is queued in the right order, and verify it was actually done.
Where you stand today, measured against a framework that fits your business and your customers.
A prioritised, costed and sequenced plan, with named owners and dates you can hold people to.
We track progress, hold vendors and internal teams to account, and keep the risk register current.
Plain-language reporting on risk, progress and investment, in a form your directors can act on.
Your IT provider cannot set your security strategy, because that asks them to assess their own work and then quote for the remedy. Mosaic takes no product commissions and resells no tooling, so the roadmap you get is shaped by your risk and nothing else. We are equally direct about where we stop. Round-the-clock monitoring and penetration testing are services we are building toward, and until they launch we will tell you who does them well rather than pretend otherwise.
A virtual CISO, or vCISO, is an experienced security executive engaged part time, typically for a set number of days each month, to own security strategy and governance for a business that does not need or cannot justify a full-time CISO. The work is leadership and decision making rather than hands-on administration.
Your IT provider builds and runs the technology. A vCISO decides what the business needs, in what order, and verifies it was delivered. Keeping the two apart matters, because asking a provider to assess the quality of their own work and then quote for the fix is not independent assurance.
Most small and medium businesses start between one and four days a month, depending on size, regulatory pressure and how much has to be built from scratch. We scope that with you before we start, and it usually reduces once the strategy and policy foundations are in place.
No. We work alongside them. In practice a good provider welcomes it, because they get clear priorities and a decision maker who understands what they are recommending.
Yes. Board and committee reporting is a core part of the role: risk stated in business terms, progress against the roadmap, and the decisions we need directors to make.
Typically from around twenty staff upward, or earlier if you hold sensitive information, serve government or enterprise clients, or operate in a regulated sector. The trigger is usually a client security questionnaire, an insurance renewal, or a board that has started asking harder questions.
Yes, where they are needed. We write a policy set sized for your business: the policy sets the mandate, supporting standards say how it is met, and both stay short enough that staff actually read them.
As a fixed monthly retainer for an agreed number of days, or as a scoped project where you need a strategy and roadmap rather than ongoing leadership. We scope and price the work before it starts, so there are no surprises.
A no-obligation conversation about where your security sits today, what your board needs to see, and what a vCISO engagement would cover.
Book a strategy conversation →