A customer, insurer, or board member asked a security question nobody can answer.
Talk it through
Answer the technology and security questions holding up your deals and renewals.
Winging it worked at 20 people. At 60, with an enterprise customer asking and one person holding everything together, you can't. I get you the answers, then make sure what they expose actually gets fixed.
When founders call The one person who knows how everything works just gave notice.
Or it’s 20 new hires and nobody has decided what they’ll run on. Or your biggest customer sent a security questionnaire, and the deal is waiting. Every one is attached to money, and most turn out to be technology and security at once.
$500K a year saved. And when the company was acquired, the buyer called IT and security one of the easiest they’d ever done.
How companies get stuck Technology and security don’t fail in silos. They fail in cascades.
One missing piece shows up in five places. The insurance question is usually an IT question in disguise. Fix the symptoms one at a time and you buy three tools and hire three consultants. Find the missing piece first, and the rest gets easier.
One gap
Nobody owns the backups
CISO
Insurance form you can’t sign
CTO
IT contract says “out of scope”
CISO
Questionnaire stalls the deal
CTO
Restore time: unknown
CTO + CISO
Board asks “are we OK?”
-
Build, buy or stop. Most of the answer is a decision, not a project: what to build, what to buy, and what to stop paying for.
-
Find the root, not the symptoms. The app nobody tested is a security finding. The contract nobody read is why nobody owns the backups.
-
Order beats volume. A short list in the order that unlocks the most, not a findings report you file and forget.
-
Plain language. Every recommendation says what it costs, what it fixes and what happens if you wait.
Track record Proof beats prose.
What changed, in numbers.
Pharma sciences CRO · regulated data
Growing Life-Sciences CRO
- GxP-validated tools
- Per-seat licensing
- Acquired
Challenge. No security program, thin validation documentation, outdated servers, and a critical per-seat analysis tool whose licenses had drifted away from who actually used it.
Outcome. Security program built from the ground up. An access review turned license sprawl into savings. At acquisition, the buyer called IT and security one of the easiest they'd ever done.
- security program
- 0→1
- easy acquisition
- 1
- saved per year
- $500K
Engineering services · professional firm
Engineering Firm
- 50 users
- Google Workspace → Microsoft 365
- Security-first
Challenge. The security controls the firm needed weren't in place, and its collaboration tools didn't fit how the team actually worked.
Outcome. Moved all 50 users to Microsoft 365 with MFA, Conditional Access and Defender on from day one. Tools matched to the work, a lower monthly bill, and nobody lost a day.
- users moved
- 50
- controls on day one
- 3
- downtime
- 0
The Intensive How we start: one question, three weeks, a fixed price.
Start with the question that’s keeping you up, technology or security. Leave with the answer, and a plan for everything it touches.
What’s included
- An answer to the question that started it, technology or security
- A map of how your systems, vendors and security depend on each other
- What to build, what to buy, and what to stop
- A plan your team can run, in order
- A readout with you, and your board if you want one
- Fixed price, agreed up front
-
Week 1: Listen. Conversations with you and the people who actually run things. I collect what exists: systems, contracts, vendors, policies, and the question in front of you.
-
Week 2: Map. I map how your technology and security depend on each other, then find the gap that shows up in the most places.
-
Week 3: Readout. An answer to the question that started it, a short list of what to build, buy and stop, and a plan your team can run, in order.
-
$7,500, fixed. Agreed before we begin. No retainer to start and no open-ended hours.
-
After the readout. Three weeks is how it starts. After the readout, you pick how it goes from there.
- You run the plan. Most teams do. You leave with the answer, the order to do things in, and nothing left waiting on me.
- I stay in it. A monthly retainer, three-month minimum. I stay in it with your team until it's done, not as a to-do list left on your desk.
- You’re ready for a full-time leader. I help you define the role, find the person and hand them the keys. Then I’m out of a job, on purpose.
About Both chairs. One plan.
I’m Mike Faas. Most companies get technology advice from one person and security advice from another, and then the two disagree. I sit in both, so the technology plan and the security plan are the same plan.
I’ve been introduced more times than I can count as “the IT guy, but not a typical IT guy.” I’ll take it. I can talk to your investors, your engineers, and the developer who knows where everything is buried. I translate geek into human, and that middle ground is where I do my best work.
I’ve spent 25 years leading technology and security at companies from 50 people to 5,000, through more than one acquisition, finding six-figure savings along the way. CISSP, based in Raleigh.
- leading technology and security
- 25 years
- people at the companies I’ve led in
- 50 to 5,000
From people who’ve worked with me What it’s like to work with me.
Mike has the ability to communicate technical concepts to a non-technical audience.”
A key contributor to both strategic direction and client engagement. Exceptional at building authentic, trust-based relationships with customers.”
Strategic leader who builds trust with customers, vendors, and direct reports alike. One of the good guys.”
Questions founders ask
- No. A list nobody owns is usually how the question got this big in the first place. The Intensive ends with a plan your team can run, in order. Then I stay in it with your team until it's done, not as a to-do list left on your desk: the decisions, the vendor calls and the follow-through.
- Don't take my word for it. The price is fixed and it's on this page before we ever talk. The track record shows what changed, in numbers. And the Intensive ends at the readout, so you find out what working with me is like before you commit to anything longer.
- No. The Intensive is three weeks at a fixed price, and it stands on its own. If you keep me on after, it's a monthly retainer with a three-month minimum. And when you're ready for a full-time CTO or CISO, I'll help you hire them. My job is to get you to the point where you don't need me.
- Keep them. They run your systems; I make the calls they're waiting on someone to make: what to buy, what to stop, what "secure enough" means for a company like yours, and whether the contract covers what you think it covers. The good ones are glad to have someone on your side who speaks both languages.
- No. They own the product; I take the security half off their plate so they can get back to building it. Security decisions, the conversations with your customers' security teams, and the insurer come to me. The architecture stays theirs. If something in the product needs to change, we decide it together, as peers, not as an auditor checking their work.
- Yes. If a good IT provider and a few decisions will cover you for now, I'll say so on the first call and point you to who can help. That's better for both of us than paying for work you don't need.
- I start with the decision, not the technology: what it has to do, what it costs to run for the life of the contract, who owns it when the person who proposed it leaves, and what it changes about your security. Usually one option falls out quickly. Sometimes the answer is neither.
Have a question nobody inside can answer?
Thirty minutes is enough to tell whether the Intensive fits. If it’s not the right fit, I’ll point you to who is.
Reach me directly
- Emailmike@nightglassadvisory.com
- LinkedInlinkedin.com/in/mfaas