What vCISO is

A personal AI security advisor for small businesses, what it does for you, and what it does not do.

Foxx Cyber vCISO is a security advisor you talk to in plain English. It is built for founders and owners of businesses with roughly five to fifty people, where nobody has the job of minding security. You do not need a security background. If you can answer questions about your business, you can use it.

You find it at vciso.foxxcyber.com. To use it you need a Foxx Cyber account, which is where you buy vCISO; see Activating your account.

What it does

• Answers your questions. A suspicious invoice, a customer asking whether you are secure, an insurer's questionnaire, or whether you need any of this at all. You get an answer in the words you used, with the reason behind it and what the fix would cost.
• Keeps your security records. As you talk, it builds a list of what could go wrong (your risk register), the policies your team follows, the decisions you have made, and the systems and suppliers you depend on. See Your security program.
• Waits for your say-so. You choose how much it may change on its own. A new account starts with everything set to Ask me first, so every change it proposes waits on the page until you approve or decline it. See You decide.
• Makes documents you can hand over. When a customer, an insurer, or a prime contractor asks how you handle security, you can send a report built from your own records. See Reports and share links.

What it is not

vCISO is an advisor, not a guarantee. You will see that line under every conversation: "Advice you decide on, not a guarantee."

• It does not make your business secure, compliant, or certified, and it will not tell you that you are. Compliance and certification are decided by assessors, regulators, and your customers.
• It is not a substitute for a security professional you hire, an incident response firm, your insurer, an auditor, an assessor, or a lawyer.
• It does not give legal advice. Questions such as whether you must notify anyone after an incident, or what a contract requires of you, are for a lawyer.
• It has no access to your computers, email, or accounts. It does not monitor your systems and it does not stop attacks. It only reads and writes its own records about your business, and you carry out anything you decide to do.
• It is not an emergency service. If something is happening right now, see In an incident.

The advice comes from an AI model working from what you tell it and from a reference library of security guidance. It can be wrong, incomplete, or wrong for your situation, and it does not know what you have not told it. What you do with the advice is your decision.

Where to go next

• Activating your account — set a password and an authenticator app.
• Telling it about your business — what it asks, and why.
• Finding your way around — the pages in the sidebar.

The full terms are at vciso.foxxcyber.com/terms and the privacy notice at vciso.foxxcyber.com/privacy.