CISO
A customer, insurer, or board member asked a security question nobody can answer.
Talk it through
Fractional CTO and CISO for founder-led companies.
For companies between $2.5M and $25M: I help you decide what to build, buy and stop, and answer the security questions holding up your deals and renewals.
When founders call It usually starts with a question nobody inside can answer.
And it’s attached to money: a deal, a contract, a renewal or a hire. Some start as technology, some as security, and most turn out to be both.
CISO
SOC 2 or HIPAA showed up in a contract and the deal is waiting on it.
Talk it through
CTO
Nobody owns technology decisions, and how things run lives in one person's head.
Talk it through
CTO + CISO
Your IT guy handles security too, and you hear about problems once they're incidents.
Talk it through
Mike has the ability to communicate technical concepts to a non-technical audience. When assigned a task, you can trust it will be done with the same level of attention to detail as if you had done it yourself.
How companies get stuck Technology and security don’t fail in silos. They fail in cascades.
One missing piece shows up in five places. The insurance question is usually an IT question in disguise. Fix the symptoms one at a time and you buy three tools and hire three consultants. Find the missing piece first, and the rest gets easier.
One gap
Nobody owns the backups
CISO
Insurance form you can’t sign
CTO
IT contract says “out of scope”
CISO
Questionnaire stalls the deal
CTO
Restore time: unknown
CTO + CISO
Board asks “are we OK?”
-
Build, buy or stop. Most of the answer is a decision, not a project: what to build, what to buy, and what to stop paying for.
-
Find the root, not the symptoms. The app nobody tested is a security finding. The contract nobody read is why nobody owns the backups.
-
Order beats volume. A short list in the order that unlocks the most, not a findings report you file and forget.
-
Plain language. Every recommendation says what it costs, what it fixes and what happens if you wait.
Track record Proof beats prose.
Names withheld. NDAs are a feature, not a limitation.
Pharma sciences CRO · regulated data
Growing Life-Sciences CRO
- GxP-validated tools
- Per-seat licensing
- Acquired
Challenge. No security program, thin validation documentation, outdated servers, and a critical per-seat analysis tool whose licenses had drifted away from who actually used it.
Outcome. Security program built from the ground up. An access review turned license sprawl into savings. At acquisition, the buyer called IT and security one of the easiest they'd ever done.
- security program
- 0→1
- easy acquisition
- 1
- saved per year
- $500K
Engineering services · professional firm
Engineering Firm
- 50 users
- Google Workspace → Microsoft 365
- Security-first
Challenge. The security controls the firm needed weren't in place, and its collaboration tools didn't fit how the team actually worked.
Outcome. Moved all 50 users to Microsoft 365 with MFA, Conditional Access and Defender on from day one. Tools matched to the work, a lower monthly bill, and nobody lost a day.
- users moved
- 50
- controls on day one
- 3
- downtime
- 0
The Intensive Three weeks. Fixed price. A clear answer.
Start with the question that’s keeping you up, technology or security. Leave with the answer, and a plan for everything it touches.
What’s included
- An answer to the question that started it, technology or security
- A map of how your systems, vendors and security depend on each other
- What to build, what to buy, and what to stop
- A plan your team can run, in order
- A readout with you, and your board if you want one
- Fixed price, agreed up front
-
Week 1: Listen. Conversations with you and the people who actually run things. I collect what exists: systems, contracts, vendors, policies, and the question in front of you.
-
Week 2: Map. I map how your technology and security depend on each other, then find the gap that shows up in the most places.
-
Week 3: Readout. An answer to the question that started it, a short list of what to build, buy and stop, and a plan your team can run, in order.
-
$7,500, fixed. Agreed before we begin. No retainer to start and no open-ended hours.
-
After the readout. Most clients run the plan themselves. If you'd rather have me in the room while you do, I stay on as your part-time CTO and CISO: a monthly retainer with a three-month minimum and no on-call promise. I only offer it at the readout, once we both know what the job is.
About Both chairs. One plan.
I’m Mike Faas. Most companies get technology advice from one person and security advice from another, and then the two disagree. I sit in both, so the technology plan and the security plan are the same plan.
I’ve spent 25 years leading technology and security at companies from 50 people to 5,000, through more than one acquisition, finding six-figure savings along the way. CISSP, based in Raleigh.
- leading technology and security
- 25 years
- people at the companies I’ve led in
- 50 to 5,000
From people who’ve worked with me What it’s like to work with me.
A key contributor to both strategic direction and client engagement. Exceptional at building authentic, trust-based relationships with customers.”
Strategic leader who builds trust with customers, vendors, and direct reports alike. One of the good guys.”
Questions founders ask
- Usually some of both. Part of it is the market. The rest is your application: insurers price what you tell them about MFA, backups and incident planning. I'll read it with you and tell you which answers are costing you money, and what it takes to change them.
- I start with the decision, not the technology: what it has to do, what it costs to run for the life of the contract, who owns it when the person who proposed it leaves, and what it changes about your security. Usually one option falls out quickly. Sometimes the answer is neither.
- Keep them. They run your systems; I make the calls they're waiting on someone to make: what to buy, what to stop, what "secure enough" means for a company like yours, and whether the contract covers what you think it covers. The good ones are glad to have someone on your side who speaks both languages.
- Three things, in plain language: what's protected and what isn't, what you've decided to accept and why, and what happens next, with dates. That fits on one page. They aren't asking for a list of tools; they're asking whether anyone owns the risk. If the honest answer is "not yet," say so and show them the plan. That beats a page full of logos.
- Yes. If a good IT provider and a few decisions will cover you for now, I'll say so on the first call and point you to who can help. That's better for both of us than paying for work you don't need.
- Both. At a company your size the questions overlap: the app, the IT contract and the insurance form are one conversation. Splitting them across two part-time people is how gaps happen. When a question needs a deep specialist, a pen tester or a senior developer, I'll say so and help you find the right one.
- A night glass is a telescope built for seeing in the dark: a wide field of view at low magnification. That's the job. Look across the whole company, find what's hard to see, and tell you what to fix first.
Have a question nobody inside can answer?
Thirty minutes is enough to tell whether the Intensive fits. If it’s not the right fit, I’ll point you to who is.
Reach me directly
- Emailmike@nightglassadvisory.com
- LinkedInlinkedin.com/in/mfaas