Security leadership is now expected of organisations far smaller than the ones that can afford it. Your largest customer sends a sixty-question security review. Your insurer asks who owns information security. NIS2 or DORA lands on an organisation where nobody has this in their job description.
And underneath those, the problem nobody sells against, because nobody serves it: the daily questions go unanswered. At a company of sixty people, “can I put customer data in this tool?” has no owner. Your engineer asks in a channel, gets three opinions and a shrug, and makes a decision that is now your exposure. No monthly retainer touches that. No compliance dashboard touches it. A consultant who visits for two days a month certainly does not.
What we built
An AI security officer that is genuinely always on, and a named human who decides what matters.
The AI CISO lives where your team already works — Slack or Teams, an email address of your own, and a portal. It answers questions against your own policies and cites where the answer came from. It assesses tool and vendor requests. It triages the email somebody thinks is phishing. It watches your suppliers, your obligations and your regulatory calendar. It keeps your policy set, your risk register, your supplier register and your audit evidence current. It drafts the answers to your customers’ security questionnaires within a day rather than three weeks.
Your Accountable CISO is a qualified professional, named on your contract. They take every decision that carries consequence, sign everything that leaves your organisation, review the AI’s work every week, and sit in front of your board, your auditor and your regulator.
We publish exactly where the AI stops
The three levels above are not a description of our intentions. They are a published document — the decision-rights matrix — which states, for every class of decision a security officer makes, whether the AI decides it alone, whether a qualified human signs it, or whether it is yours to take.
You can check us against it. You can hand it to your own auditor when they ask — as they will — what an AI is doing answering security questions inside your organisation. And you can ask any competitor selling autonomous AI security for theirs, which is a more revealing question than it sounds: writing the document forces an admission either that a human is in the loop, or that nobody is accountable.
The boundary is also enforced rather than promised. Our agents have no capability to send outbound email at all, no agent may record a decision outcome, and a risk acceptance requires your own named person — there is no code path that would let us accept a risk on your behalf.
What we will not claim
The AI CISO is not your accountable officer. Under NIS2 and DORA accountability sits with your management body and cannot be delegated to a supplier, still less to software. What this service gives you is a security function competent enough to discharge that accountability, and a named human standing behind it. Any provider implying otherwise is selling you a position that will not survive contact with a supervisor.
We do not guarantee that every AI answer is correct. Level-one answers are advisory, logged and sampled — not individually reviewed before they are given. We say so in writing, because a provider claiming every answer is human-checked is either not always-on or not telling you the truth. What we do instead is publish the sampling regime, hand you the complete log whenever you ask, and correct errors in the open.
We do not make you secure, and we are not your monitoring service. We advise, direct and report; we do not watch your estate around the clock or perform containment.
And we will tell you when you do not need this. An organisation of eight people with one product and no regulated data usually needs three specific things fixed, not a standing security function. We will say so on the call.
What the first ninety days look like
- Days 1–15 — baseline and channels. We map your environment, obligations and crown jewels, and give you a written baseline: what exists, what does not, what genuinely exposes you. The AI CISO goes live in your workspace in the first week, so the daily questions start being answered immediately.
- Days 16–45 — the governance layer. The policy and standard set is drafted against your actual environment, corrected by your Accountable CISO, reviewed with you and formally adopted. Your risk treatment plan gets owners and dates.
- Days 46–90 — evidence and the outside world. Supplier reviews begin, the evidence library is built so questionnaires stop being a fire drill, the incident response plan is written and walked through, the awareness programme starts, and your first board pack is delivered.
After that it is continuous: the AI CISO working every day, a human turning round decisions inside your tier’s response time, a signed report each month, a board pack each quarter, and an exercise and a full review each year.
How it fits with Integrico Assured
CISO as a Service is the governance service within Integrico Assured — the officer, the policies, the risk, the suppliers, the evidence, the reporting, and the person accountable. The technical services alongside it — security testing, code review, vulnerability scanning and cloud posture — are AI-driven, continuous testing of the software and infrastructure themselves, with the same model of automation carrying the volume and a named expert signing the result.
They are sold separately and work better together. The CISO service decides what must never fail and has to prove it to an outside party; the technical services are the machinery that keeps proving it on every release. Taken together they are priced as a bundle.
Who it is for
Growing SaaS and technology businesses whose customers have started running security reviews. Financial services firms, payment businesses and insurers in scope of DORA. Organisations newly captured by NIS2 — energy, water, transport, healthcare, digital infrastructure, manufacturing, and suppliers to the public sector. Private-equity and venture-backed companies needing a defensible security position before a raise or a sale. And any organisation whose board has asked the question and found that nobody in the room owns the answer.
And it is not only for organisations without a CISO. Where you already have one, the service runs in support mode: the always-on AI CISO and the artefact machinery carry the daily questions, the registers, the supplier reviews, the evidence and the questionnaire drafting, while your own officer keeps accountability and spends their time on the decisions that need a person rather than on keeping the system fed. You get the capacity of a security team without growing one, and your CISO stops being the single point of failure.