ON The operator seat
The operator node
Where your security program actually lives.
The problem
Where does the security program live?
Every engagement produces artifacts — a risk register, a WISP, policies, findings, evidence. The traditional answer to where they live is a PDF, emailed once, then scattered across inboxes and shared drives.
A PDF is stale the day it is delivered. No version history. No access control after send. No provenance. And when diligence comes, somebody has to reconstruct what was true and when — from attachments.
The operator node is the alternative: one hardened appliance that holds the living register, the ISMS, every deliverable and the evidence trail, on your keys, at a known location. You still get Word, Excel and PDF whenever you want them — generated from the live source rather than standing in for it.
What gets commissioned
An appliance, a workstation, and a hardware root.
The node
A mini-PC running open-source firmware (coreboot/Dasharo) with the management engine neutralized. Holds the vault, the register, the ISMS and the evidence.
The workstation
A laptop assigned to your engagement only — field collection, interviews, analysis and drafting, offloading continuously into the node.
The hardware root
A hardware key gates disk encryption, admin access and commit signing; an HSM holds the BYOK vault. No key, no access.
The difference that matters
No commingling — structurally, not as a promise.
Standard consulting practice runs every client off one laptop. If that machine is lost, compromised or subpoenaed, every client on it is exposed. The workstation assigned to your engagement has never held another client's data, and never will.
The build
Roughly 40–60 hours of engineering, then handover.
- 01
Procure and verify
Vendor-direct procurement with firmware verified on record — not a gray-market channel. The machine holding the evidence should itself have known provenance.
- 02
Harden and enroll
Hardened OS build, full-disk encryption, services reduced. Hardware-key enrollment for FDE unlock, admin auth and commit signing.
- 03
Stand up the program
BYOK vault initialized on the node, the risk register configured, the ISMS policy framework loaded and mapped, report generation wired to the live source. Included, not extra.
- 04
Mesh and scaffold
Tailscale enrollment and ACL design, with read-only roles for sponsor and counsel. Connector scaffolding for the six pillars.
- 05
Prove and hand over
Backup configured and a restore verified before handover. Operator runbook, admin documentation and a working session.
Deployment
Three models, chosen to fit custody.
| Model | How it works | Best for |
|---|---|---|
| Client-sited | The node sits in your environment and you hold physical custody; the operator connects over the mesh. | Maximum client control |
| Operator-sited | We hold and operate the node; you hold named read access and receive exports. | Fastest start |
| Dual node (paired) | One node each, git-synced — continuity if either side is unavailable, and a clean handover at the end. | Portfolios and M&A prep |
Access runs over a zero-trust mesh: no listening service to attack, no VPN concentrator to breach, no shared credential. Hardware is sourced at cost through direct vendor relationships and invoiced with the vendor invoice attached.
The contract layer
How AI is used, in writing.
How AI is used across the engagement — what is aliased, what never enters an AI system, and which platforms are approved — is governed by the AI Data Handling Standard, a document written to be annexed to your MSA or SOW and reviewed by your security, legal or diligence team.
It classifies every piece of client material as Prohibited, Restricted, Internal or Public, and the classification decides what may reach an AI system and in what form. Secrets, credentials, live PII and raw client datasets are never submitted to any AI system, on any platform. Where your own AI policy is stricter, yours controls.
The node is the architecture; the Standard is the contract. Commissioned during Phase 0, so the program has somewhere audited to live from day one.
Honest about the line
When you do not need this.
Honest limit
You are securing your own estate
For a homelab or a single organization, a node you build yourself is real and capable. The DIY build guide on ciso.diy walks the whole thing, and the provenance record is simply yours to keep.
Honest limit
Nobody is asking who held the data
Documented provenance, a dedicated no-commingling workstation and a certificate of sanitization at exit are what diligence asks for. If nothing you hold is heading into diligence, that machinery is overhead.
Honest limit
You want the method, not the appliance
The methodology is public. The C2 manual and the DIY build guide teach the operating model and the build; this service is us building and running it for you.
Rather build it yourself?
The Operator Node — DIY Build Guide
The same architecture as a build guide: harden the base, stand up the vault, deploy the register and ISMS, mesh it with zero trust, enroll the hardware root, and wire the one-click sever. Six steps with the commands, and a fillable build-day runbook.
Research
Latest from the blog
compliance · Oct 18, 2026
CIRCIA's Final Rule Nears Publication, but OT Operators Still Can't Prove Data Integrity
CISA's final CIRCIA rule is now with the White House for review, but the reporting mandate still assumes operators can trust their own telemetry — a gap OT environments haven't closed.
ciso-strategy · Oct 17, 2026
Proofpoint's $6.3B Varonis Deal: What the Data-Security M&A Wave Means for Your Contracts
Proofpoint will pay $6.3 billion for Varonis, creating a 16,000-customer data and AI security giant. Here's what current customers of both vendors need to ask before the 2027 close.
supply-chain-security · Oct 17, 2026
AI Audit Finds 25-Year-Old Curl Bug on 20 Billion Devices: CVE-2026-8932
An AI-powered audit of Curl uncovered a 25-year-old authentication bypass affecting billions of devices, surfacing 35 CVEs that human review missed for decades.
Start an engagement