The AI Security Department
Point-in-time testing can't keep up. A standing program can.
A continuous, AI-augmented security program covering compliance, testing, SOC triage, incident response and a fractional CISO, conducted from one operator seat. It runs on your keys and conducts the tools you already own.
Vendor-neutral · BYOK · conducts your existing tools · can be severed in one click
Why the model broke
The annual pentest was built for a slower world.
Software ships daily and attackers automate. A static report once a year leaves you blind most of it, and says nothing about whether the holes ever closed.
| Dimension | Traditional pentest | DIY (scanner + freelancer) | Integrated program |
|---|---|---|---|
| Cadence | Once or twice a year | Ad hoc | Continuous |
| Coverage | Varies by tester | Varies wildly | Consistent, every time |
| Did the hole close? | Unknown | Unknown | Re-tested and confirmed |
| Reads your alerts? | No | No | AI-SOC reads every alert |
| Owns the outcome? | No | No | Fractional CISO |
One brain, six pillars, one seat
A whole security department, run by AI under one operator.
Six capability pillars reason over one shared knowledge base: your assets, topology, findings and history, with a living risk register. Each pillar wears a different hat; the brain underneath is the same.
Where every engagement begins
Phase 0: the enterprise AI risk assessment.
The pillars aren't sold off a shelf. They're built into your ecosystem, and that means mapping it first. Nothing downstream is priced until Phase 0 is delivered.
Maps the whole AI and security footprint
Every AI system in use (sanctioned and shadow), the DevSecOps reality, the data and identity stack, the SIEM/EDR landscape, and where testing should start.
Defines the functional model
How each pillar gets built for you: BYOK and open-source tooling as the foundation, with commercial upgrades where they earn their place.
Designs the integration seams
Where the program snaps into what you already run, conducting your tools rather than replacing them.
Plans the deployment topology
For distributed organizations, a collection plane that reaches every site and segment without a per-site VPN.
How it works
The loop nobody else sells.
A point tool detects. A pentest reports. Neither proves the hole is closed. The program does, because offense and defense feed the same brain.
- AI-SOC catches
- Human gate
- PTaaS re-tests
- Confirmed closed
Everything runs on your keys: you pay for the operator and the judgment, not the compute. The platform conducts your existing tools and never rips them out, and the AI layer can be cut off in one click with production untouched.
Two ways to engage
The whole department, or a single service.
The program
Full program
Begins with Phase 0 · program priced after
- Phase 0 enterprise AI risk assessment first
- All six capability pillars, one brain
- Detect-verify loop and a living risk register
- On your keys, conducting your tools
À la carte
Individual services
182 fixed-scope services with published starting prices
- Penetration testing, red and purple teams
- AI red teaming and AI governance
- Compliance readiness and board briefings
- A clean way to prove value before the program
Rather build it yourself? Every pillar is published as a practitioner build guide on ciso.diy, with the Phase 0 methodology here.
Research
Latest from the blog
ciso-strategy · Oct 17, 2026
Proofpoint's $6.3B Varonis Deal: What the Data-Security M&A Wave Means for Your Contracts
Proofpoint will pay $6.3 billion for Varonis, creating a 16,000-customer data and AI security giant. Here's what current customers of both vendors need to ask before the 2027 close.
supply-chain-security · Oct 17, 2026
AI Audit Finds 25-Year-Old Curl Bug on 20 Billion Devices: CVE-2026-8932
An AI-powered audit of Curl uncovered a 25-year-old authentication bypass affecting billions of devices, surfacing 35 CVEs that human review missed for decades.
ai-security · Oct 15, 2026
NVIDIA DCGM Exporter Flaw Exposes GPU Fleets: AI Infrastructure Needs a Patch Now
A high-severity DoS flaw in NVIDIA's DCGM Exporter, paired with 2,100 exposed GPU monitoring servers found by researchers, shows AI infrastructure telemetry is going unguarded.
Start an engagement