Security Advisor · Operate

An external CISO for companies of 10 to 250 employees.

Axyom Agent reads your company's real posture and answers at any hour, in the portal or inside your Slack. When the decision calls for judgment, a human CISO steps in, included from the Pro plan, with a session of up to one hour and written minutes of the agreed actions.

The domain scan is free. The advisor comes with the Pro plan.

Continue in Axyom: we will ask for your domain there.

What it is

An external CISO in two layers.

It is someone with security judgment who answers for your company without being on your payroll. The position costs more than a company of 10 to 250 people can justify, and yet the decisions that position makes still get made: who has access to what, whether to accept a supplier's security annex, whether you go for ISO 27001 this year or next.

Today those decisions fall to the head of IT, the CTO or the partner who worries most. That person deals with the urgent first and the work of deciding waits. The decisions get made all the same, with less information than they should have and with nobody signing them.

Stringing together project-based consulting engagements leaves reports that are out of date within three months, because they describe one particular day and your surface changes every week. The cost shows up when a large customer sends their security annex, when an auditor asks you to defend an exception or when you have to decide whether an incident gets reported.

180

euros for a single session

150

euros a month, one session

390

euros a month, three sessions

What it is: An external CISO in two layers: the agent answers questions about your file at any hour and the person steps in when the decision calls for judgment. Both layers share the same file and the same figures as the portal.

Who it is for: Companies of 10 to 250 employees where security falls to someone who already has another job. It fits when a customer or an auditor is already asking you for security proof and there is nobody in-house to decide on it.
Where it's included: In Pro, on escalation according to the service conditions. In Max, a named person with a monthly session of up to one hour. Free and Base are self-service and include no advisor sessions.
What we need: Your file up to date: the domain verified and the integrations you use connected, because the advisor answers questions about what they can consult. And a private Slack channel with your team.
Cadence: In Pro, on escalation when the decision calls for it, according to the service conditions. In Max, a monthly session of up to one hour with the same person and follow-up of the agreed actions.

When the person steps in

The decisions where the person steps in.

These are the situations your team escalates to the person, with the file already loaded and the decision in writing.

Incident in progress: Whether the case becomes serious and whether it gets reported, with the detection time and the evidence recorded.
Customer questionnaire: What gets answered, with which evidence and what gets committed in writing to the customer asking.
Audit and exceptions: Defending an exception in front of the auditor and standing by the judgment with which it was approved.
Contracts and annexes: Accepting or negotiating a supplier's security annex, and the clauses that come with it.
Risk acceptance: When a risk is accepted rather than closed, who accepts it and until when.
Certification plan: Whether you go for ISO 27001 this year or the next, and what has to move first.
Access and permissions: Who has access to what and what gets removed when someone changes roles or leaves.
Insurance policy renewal: What gets declared to the insurer, what the policy covers and what goes to the board.

Access to the person exists from Pro. In Free and in Base the platform answers and leaves the backlog prioritized, without advisor sessions.

Agent and person

Who does what, without ambiguity.

With any product that mixes AI and people you need to know where one ends and the other begins, so the split is written down.

Pro

On escalation, according to the service conditions

The person steps into the same thread when the team escalates a decision that calls for judgment, with the file already in front of them. The agent answers the rest of the time, in the portal or in your Slack channel.

Max

A named person and a monthly session

Always the same Axyom CISO, with a monthly session of up to one hour that ends with signed minutes. They also step into audits, customer questionnaires and due diligence, and have priority response when there is an incident.

Sessions

Single sessions and packs

A single session costs €180, with no lock-in. One a month is €150 a month and three a month €390 a month, for audit, certification or due diligence seasons. All of them last up to one hour and end with written minutes.

The minutes of every session

Every session ends with written minutes recording the agreed actions and their owners. They are signed by the Axyom CISO who ran it and stay in the portal, next to the rest of your file, so the following month the conversation starts from there. The portal's change log keeps who did each thing and when.

Sample review with the advisor · Sample data

Axyom Agent: There is an expired certificate on an exposed service of the company. The finding and its evidence are in the file.
You: What do we need to review first?
Axyom advisor: Let's check which service depends on that certificate, whether it affects customers and who can renew it. With that information we'll agree on the priority and the owner.
Agreement: IT will review the service and document the fix. The security lead will follow the progress.

What you take away

Three things that end up in writing.

The prioritized plan

The actions ordered by severity, with owner, step-by-step playbook and estimated effort in minutes. Every change stays in an auditable log, with who did it and when, and the score moves when you upload the evidence.

The signed minutes

The agreed actions with their owner, signed by the Axyom CISO who ran the session. They stay in the portal, so the following month you review what is pending instead of retelling the context.

The support

In Max, the person joins you in audits, customer questionnaires and due diligence, with the file in front of them and the history of what you have already decided. In Pro the person steps in on escalation and answers questions about the same file.

Where it fits in the platform

The person works on what the modules measure.

The advisor is the human layer on top of what the other modules produce, with the same file in front of them: the scanner's findings, the pentest report, the credentials that appear in Threat Intelligence and the status of each framework. The person arrives at the session with what the platform has been seeing every day, so the hour is spent deciding.

Limits

What this advisor does not do.

Check the scope before turning on the module and coordinate with your team the actions that fall to them.

It does not replace an in-house CISO

It is sized for companies of 10 to 250 employees. Above that size the conversation is different and so is the plan.

It does not assume legal responsibility

It brings judgment, leaves minutes and provides support. Regulatory responsibility remains with the company and its governing body.

It executes no changes on your systems

It drafts the fix and leaves the playbook with its estimated effort. Execution belongs to your team or your IT provider.

The session has an agreed scope

The session lasts up to one hour and is scheduled according to the service's availability. In Pro access goes through escalation; Max includes a named person and a monthly session.

It answers questions about what is connected

If a system is not integrated, the platform does not see it and says so. It does not invent the status of what it cannot consult.

It does not provide forensic expert work or legal defense

In an incident with legal consequences the advisor provides support. Forensic expert work and legal defense are contracted separately or are covered by the insurance policy.

There is no advisor in Free or Base

Both plans are self-service: the platform answers and leaves the prioritized plan. Access to the person starts in Pro.

Plans

The human advisor comes with the Pro plan.

In Pro they step in on escalation according to the service conditions. In Max it is a named person, with a monthly session of up to one hour and written minutes, plus support in audits and questionnaires.

Free

To see your real risk before deciding anything.

€0

No cost · No card.

Everything to get looking:

Continuous scan External surface, 24/7
Posture and risk map Real-time CyberScore
Leaked credentials Counted, no detail

Start free

Base

For companies that want the whole platform without a security team of their own.

€190 / month

Self-serve · No commitment.

Everything in Free, plus:

Integrations Microsoft 365, Google Workspace and cloud
AI risk Apps with permissions over your data
Prioritized backlog Monthly remediation
1 domain Continuously scanned

Get Base

Pro

For teams that need every sensor active and an expert behind it.

€990 / month

Advisor on escalation · No commitment.

Everything in Base, plus:

Security advisor On escalation, with SLA
Threat Intelligence Exposed credentials, under watch
Recurring pentesting Authenticated, report reviewed by Axyom
MDR 24/7 Up to 20 managed devices
Up to 5 domains All continuously scanned

Get Pro

Max

For high exposure or compliance demands.

€1,990 / month

Dedicated advisor · No commitment.

Everything in Pro, plus:

Dedicated security advisor A fixed person, monthly session
Priority response Incidents
Compliance by framework Downloadable evidence and attestation
Audit support Customer questionnaires and due diligence

Contact sales

FAQs.

Is it a real person or just a chat?

Both layers exist and the split is written down. The platform answers questions about your file at any hour. The human CISO steps in when the decision calls for judgment: in Pro on escalation according to the service conditions, and in Max a named person with a monthly session of up to one hour and written minutes with actions.

How quickly does the advisor respond?

Queries and sessions follow the timelines and the procedure of the contracted service. In Pro the advisor intervenes on escalation. In Max you have a named person and a monthly session to review the decisions and the follow-up.

How is it different from an hourly advisor?

An hourly advisor starts every session rebuilding the context, and between sessions nobody is watching. With Axyom the platform watches every day and the person arrives with the file loaded, so the hour is spent deciding.

Does the human CISO assume legal responsibility?

They bring judgment, leave minutes with the agreed actions and provide support in audits, questionnaires and due diligence. Legal and regulatory responsibility remains with the company and its governing body, which answers to the regulator.

How much does a session with the human CISO cost?

A single session costs €180, one session a month is €150 a month and three a month €390 a month. In Pro, escalation according to the service conditions is included in the plan, and in Max the monthly session with minutes is too.

Choose how to start.

On your own

Analyze your domain and start with your security posture. Then connect your systems and turn on the capabilities you need.