Deputy, Interim and Fractional CISO leadership, with the delivery capability to produce the outcome. One accountable executive, a delivery team behind them.
Alongside your CISO · Between CISOs · Before your first CISO.
Deputy, Interim and Fractional CISO leadership, with the delivery capability to produce the outcome. Alongside your CISO, between CISOs, or before your first.
Senior capacity beside your existing security leader, under their authority.
Leadership continuity while the permanent appointment is made.
Security leadership before a full-time CISO is required.
Oversight is eating your leadership time.
Cross-functional efforts nobody holds.
A full-time hire isn’t warranted yet.
A serious event with no senior owner to run the response.
Assurance work crowding out the roadmap.
One accountable hand to carry it to done.
The role defines where we fit. The engagement defines what we deliver.
Every security team carries three loads: strategy, delivery, operations. Then a fourth: the reporting, metrics, evidence and assurance that has no owner and lands on the CISO. We engage in whichever of three shapes fits the decision in front of you.
Independent judgement and confidential support for the consequential decisions, a senior peer to think out loud with, and preparation for the rooms that matter.
Ongoing senior capacity delivered as Deputy CISO, Chief of Staff to the CISO, or without a formal title. Governance, delivery and executive coverage, run month to month.
One defined outcome (board reporting, audit readiness, an operating model, or the response to a live incident), owned through to completion, on a date agreed in advance.
Deputy CISO and Chief of Staff to the CISO are two ways the Office of the CISO engagement can appear inside your organisation: titles, not separate services.
| Counsel | Office of the CISO | Mission | |
|---|---|---|---|
| Purpose | Independent judgement | Ongoing senior capacity | One defined outcome |
| Structure | Continuing advisory relationship | Partner-led monthly engagement | Defined scope and completion date |
| Includes | Counsel, review and preparation | Counsel, governance, delivery and executive coverage | Outcome team and complete deliverables |
| Commercial model | Fixed monthly fee | Fixed monthly fee | Fixed mission fee |
At the start of an engagement we agree the outcomes in motion, their completion criteria, the key dates and the dependencies. New priorities can enter at any time; together we decide what moves, what pauses and what needs separate scope, so the work stays flexible and the economics stay fixed.
Your partner stays accountable and client-facing; a multidisciplinary team delivers behind them.
Fees reflect operating intensity and agreed outcomes, not the number of people assigned.
Scoped as results, never billed per head.
Outcomes, dates, dependencies and completion criteria set upfront and reviewed regularly.
Every number ties back to evidence you can defend.
Notice either side, everything handed over.
Builds security that holds.
Over thirty years, he progressed from security engineer and architect to enterprise security executive. He still approaches the work the same way: understand how something can fail, then build the controls, operating model and accountability needed to make it resilient.
His career spans HPE, AWS, Google and IBM. Most recently, he led enterprise security for a 20,000-person group operating across 40 countries.
Through Keystone, Ankush works as a senior second to sitting CISOs, providing independent counsel, executive coverage and accountable ownership of priorities that would otherwise remain on the CISO’s desk. He stays personally accountable for the relationship, supported by a multidisciplinary delivery team that carries the work through to completion.
A few examples of the output your team would otherwise build by hand. Illustrative, but true to the shape of the real thing. These are representative outcomes, not a fixed service catalogue; priorities are selected and sequenced through the engagement.
Built, with the story behind every number, ready before you’re asked.
| Metric | Now | Target | Trend | Status |
|---|---|---|---|---|
| Critical assets patched ≤ 14 days | 62% | 85% | ▲ | Breach |
| Mean time to detect (hrs) | 9.4 | 4.0 | ▲ | Breach |
| Mean time to respond (hrs) | 26 | 24 | ▲ | Watch |
| Endpoints with EDR coverage | 94% | 98% | ▲ | Watch |
| Privileged accounts under PAM | 58% | 90% | ▬ | Breach |
| Backups restore-tested in period | 81% | 75% | ▲ | Met |
| Staff completing phishing training | 96% | 95% | ▲ | Met |
Collected once, kept current, produced on request.
| Control family | Frameworks | Evidence |
|---|---|---|
| Access control & review | 5 | Current |
| Change management | 5 | Current |
| Vulnerability management | 4 | Current |
| Encryption & key handling | 4 | Stale |
| Logging & monitoring | 4 | Current |
| Backup & restore testing | 3 | Stale |
| Supplier management | 3 | Missing |
The right way to execute: centralized, hybrid or federated.
| Function | Runs where |
|---|---|
| Governance & policy | Central |
| Detection & response | Managed + central |
| Identity & access | Central |
| Cloud security | Federated to platforms |
| Application security | Embedded in product |
| Third-party risk | Central |
| Metrics & reporting | Central · Keystone-run |
Tell us what is on your desk this month. If we can take it off you, we will say how, and if it’s not us you need, we will point you to who is.
Thank you, we’ll be in touch within a business day. Come with the one thing you’d most like off your plate; that’s where we’ll start.