01vCISO advisory
GPT-5.3-Codex vCISO advisory
Fractional CISO delivery powered by GPT-5.3-Codex, OpenAI's first model classified as 'High capability' for cybersecurity: threat analysis, board reporting, policy generation and compliance program management, delivered by a TAC-verified practitioner.
+ What's included
- Security program development and roadmapping
- GPT-5.3-Codex-generated board and executive reporting
- Policy and procedure generation with OpenAI APIs
- Ongoing threat intelligence briefings at the verified access tier
- Frameworks: NIST CSF, ISO 27001, SOC 2, CMMC, HIPAA
Monthly retainer
02App security
Codex Security application assessment
Full repository scans with Codex Security, OpenAI's application security agent (formerly Aardvark). It builds a threat model of your system first, validates candidate vulnerabilities in sandboxed environments before surfacing them, and produces working proof-of-concepts for confirmed findings.
+ What's included
- Full codebase scan with system-context threat modeling
- Findings validated in sandboxes: no raw AI output
- Working proof-of-concepts for confirmed vulnerabilities
- Patch proposals scoped to your actual codebase
Project
03Pentest
AI-augmented penetration testing
Penetration testing, red teaming and vulnerability assessment accelerated by GPT-5.3-Codex at TAC-verified access. The model works through complex attack chains (reconnaissance, enumeration, exploitation paths) at a scale that changes what fits in a standard engagement.
+ What's included
- Network, application and cloud penetration testing
- Autonomous multi-step attack-chain analysis
- AI-drafted executive and technical reports, reviewed by a practitioner
- Remediation roadmap with prioritized actions
- Healthcare, energy and critical infrastructure experience
Project
04Compliance
GPT compliance automation
GPT-5.3-Codex deployed against evidence collection, gap analysis, policy documentation and audit preparation. TAC-verified access means the model can engage with compliance scenarios that standard API access throttles.
+ What's included
- CMMC, SOC 2, HIPAA, PCI DSS, ISO 27001
- Gap analysis against your current posture
- Policy generation and maintenance workflows
- Evidence collection and audit preparation
- Ongoing compliance monitoring with AI-generated alerts
Project + retainer
05Incident response
Incident response with GPT-5.3-Codex
Incident response where GPT-5.3-Codex accelerates triage, timeline reconstruction and IOC analysis, including binary analysis of suspicious executables without source code. TAC verification removes the throttles that would otherwise limit this dual-use forensic work.
+ What's included
- Log analysis and timeline reconstruction
- Binary executable analysis for malware triage, no source required
- IOC identification and threat actor attribution support
- Stakeholder and regulatory notification drafting
- Retainer option; response terms are set in the SOW
Retainer
06Supply chain
Supply chain and third-party component review
Assess third-party compiled components, a category that has been largely opaque to traditional methodology. GPT-5.3-Codex can analyze compiled software for malware potential and vulnerabilities without source code: critical for M&A due diligence and vendor risk programs.
+ What's included
- Compiled binary analysis of third-party components
- Source-free vulnerability assessment for M&A due diligence
- Vendor risk scoring with AI-assisted deep analysis
- SBOM review and gap identification
- Supply chain attack surface mapping and remediation
Project