vCISO & MSP Security Program Delivery
Runs many client security programmes at once.
Overview
Service providers delivering vCISO, compliance or managed security work have a different problem from an in-house team: the same programme repeated across dozens of clients, each with its own frameworks, evidence, roadmap and reporting, under strict data separation and per-client billing. Purpose-built platforms provide multi-tenant workspaces, templated assessments, generated policy sets and roadmaps, and client-branded reporting. The category has grown quickly because vCISO is now the mainstream way small and mid-sized organisations get a security programme at all.
Only relevant if you deliver security to others — but decisive for margin if you do.
Advantages
- Templated assessments and generated roadmaps turn a bespoke engagement into a repeatable product
- Multi-tenant separation with per-client branding is the practical requirement, and hard to retrofit
- Consistent deliverables mean a junior consultant produces work the practice can stand behind
- Per-client usage data makes billing and scope creep visible
- Client-facing portals shift status reporting from meetings to self-service
Trade-offs
- Generated policies and roadmaps are only as good as the assessment behind them, and clients can tell
- Platform lock-in is severe — migrating a book of clients is close to impossible
- Per-tenant pricing punishes the long tail of very small clients
- Templating pushes practices toward sameness, which erodes the differentiation they sell on
- Cross-tenant data separation is a genuine breach risk and needs verifying, not assuming
Open-source option
Eramba and CISO Assistant can each be run as separate instances per client, which gives clean isolation at the cost of operating one deployment per customer. Neither offers a practitioner console across the book of clients, cross-client reporting, or per-tenant billing — the multi-tenancy is the product here, and it is exactly what open source does not supply.
Vendors & tools in this area
Partner-managed tenants with a vCISO workspace and metered billing.
Visit site →