foxxcyber/docsTelling it about your business
What your vCISO asks in the first conversations, where the answers are kept, and how they shape the advice.
There is no long setup form. Your vCISO learns about your business by talking to you, one question at a time, and writes down what it learns as it goes. The first conversation opens with:
Tell me about your business. What it does, and what it would hurt most to lose. I will work out where you actually stand from there, one question at a time.
What it asks, and why
What the business does and what it runs on. Your industry, how many people you have, and the systems you use every day, such as your email, accounting, file storage, and any line-of-business software. Advice for a ten-person accounting practice is different from advice for a machine shop.
What it would hurt to lose. For each important system it asks a few plain questions:
- How long could you keep working if this stopped on a Monday morning?
- What would one day without it cost you? Lost work, idle staff, invoices not going out. A rough number beats no number.
- If what is in it were gone for good, could you get it back?
- What would happen if outsiders read it?
These answers decide where protection should go first, and whether a fix is worth its price. A fix that costs more per year than a day of downtime is usually not worth it, and your vCISO will say so.
Who owns security, and how much risk you will carry. Most owners have never been asked. Your vCISO often starts here, because every other recommendation is a trade-off against that line.
What you can spend. A yearly figure for everything security-related, so it can weigh each recommendation against what is left.
Your goals. Things nothing should get in the way of, such as "onboard clients in under a day." Your vCISO is told not to recommend anything that would get in the way of a stated goal without saying so and letting you choose.
Where the answers are kept
What it learns lands on a few pages you can read and correct at any time:
| Page | What it holds |
|---|---|
| Your business | Business name, what you do, how many people, the systems you use, your goals, and anything else worth knowing. |
| What you depend on | Each system and supplier, and what losing it would cost. See What you depend on. |
| Your limits | How much risk you will carry and your yearly budget. See Risks and your limits. |
Every time you send a message, your vCISO is given your business profile, your limits, and the systems you depend on, and it can look up the rest of your records while it answers. That is why the next conversation builds on the last one instead of starting over.
Correcting it yourself
Open Your business in the sidebar to see what your vCISO knows about you. Change anything it got wrong and click Save changes.
Be specific in Systems you use, and separate them with commas. Your vCISO checks these names against flaws attackers are using right now, and "Microsoft 365" matches where "cloud email" cannot. See Being exploited right now.
Your spending and your risk line are not on this page. They live on Your limits, where they are numbers your vCISO is actually held to rather than notes it reads.
If you turn off Remembering your business in Settings, your vCISO stops writing down what it learns, and each conversation starts from scratch. See You decide.