PT Prefer a light background? Click here.Prefer dark mode? Click here. Talk to Zulti →

CISO & CTO as a Service · security and technology

Security and technology with an owner,
no full-time hire.

An annual master plan, a seat on the committee and in executive meetings, evidence organized for the next audit and independent opinions for vendor selection. Zulti takes the security seat, the technology seat or both, at the right pace for a company without a dedicated C-level seat.

Book 15 min → See both seats ↓

PSA · Governance & Compliance · Risks

Risk register in PSA: likelihood × impact heat map, treatment progress and most serious risks

model

monthly fee + projects

client

no in-house CISO or CTO

committee

executive presence

Two seats, one team

Security, technology or both.

Each seat can be hired on its own. Together, security and technology decisions come from the same table, with the same context.

CISO as a Service

Security leadership.

For companies without an in-house CISO: Zulti plans, leads and reviews your security posture.

Annual Security Master Plandocumented posture, risk map and prioritized initiatives
Risk opinionsvendor assessment, choosing between options (SIEM, EDR, SOC), incident response plan
Leadership of the compliance programISO 27001 / 27002 / 27701 / 42001 + LGPD: applicable standards, prioritized gaps and guided compliance
Committee presencea permanent seat, translating technical risk for the board

CTO as a Service

Technology leadership.

For companies without an in-house CTO: technical decisions with a business mindset.

Annual Technology Master Planstrategy, milestones, planned investments and what’s in and what’s out
Technical opinionschoosing ERP, CRM, platforms and tools, with impartial analysis
Ongoing technical leadershipa permanent technical voice for companies without a CTO
Presence in executive meetingstranslating business decisions into technology action, and vice versa

Monthly retainer + fixed-scope projects billed separately. Recommendations based on fit for your case, not on a sale.

The starting point

In security and technology, a company doesn't get to choose when to decide. Improvising becomes an expensive bill.

Clients ask, auditors push, regulators demand, systems hit their limits. With nobody in the CISO or CTO seat, every decision becomes a fire drill under pressure. The on-demand seat gets there first: a monthly fee, no full-time hire.

CISO · 4 areas

The security seat, area by area.

Information security and privacy integrated into the ISMS (the security management system), under a single owner who translates technical risk into board decisions. What the CTO delivers is in the two seats, above.

— Area 01

Risk opinions

Vendor risk assessment, SIEM/SOC/EDR. You bring the decision; Zulti returns a written analysis under the monthly fee, not tied to any sale.

written opinion · on demand · fee separate from any sale

ISMSpolicy ACLaccess OPSoperations IRCincident VENvendor LGPDprivacy

— Area 02

Security Master Plan

The core deliverable. An annual document with an assessment, a risk map and initiatives prioritized for the short, medium and long term. Validated by the security committee.

annual deliverable · validated by committee

ISMSpolicy ACLaccess OPSoperations IRCincident VENvendor LGPDprivacy

— Area 03

Leading the compliance program

The CISO defines which standards apply (ISO 27001 / 27002 / 27701 / 42001 + LGPD), prioritizes the gaps and leads the remediation. The formal build-out (controls, evidence, audit readiness) runs as the Security & Complianceprogram. Certification is issued by an accredited certification body.

leads the compliance work · build-out is the S&C program

ISMSpolicy ACLaccess OPSoperations IRCincident VENvendor LGPDprivacy

— Area 04

Committee seat

A permanent seat on the risk and security committee. Brings to the CEO's table what's in the plan, open risks and decisions that need to be made. Holding steady between audits.

agreed frequency · an executive, not a vendor

ISMSpolicy ACLaccess OPSoperations IRCincident VENvendor LGPDprivacy

— Working alongside your in-house team

The on-demand CISO and CTO are not the "bosses" of your IT team. When there's in-house IT (analyst, coordinator, manager), the role is direction: it defines the "what" and the "why". The in-house team handles the "how". The line is clear and agreed from day one, with no competition and no overlap.

separate roles · agreed at onboarding

today × Zulti CISO & CTO

Who decides on security and technology today. And who would decide with Zulti.

A binary heat map of the 6 areas the ISMS covers. Where today the topic is left to technical improvisation versus where on-demand leadership brings written criteria.

— ISMS area

today No CISO senior IT takes it on informally

with Zulti On-demand CISO recurring seat · monthly fee

ISMS · policy Formal written policy, approved and in force

today

technical improvisation

with Zulti

document in force

ACL · access MFA, RBAC and periodic permission reviews

today

partial · no review

with Zulti

quarterly · auditable

OPS · operations Backup, logs and patches in agreed windows

today

no testing · no retention

with Zulti

validated quarterly test

IRC · incident Response plan + annual tabletop

today

no plan · real panic

with Zulti

runbook + annual tabletop

VEN · vendor Vendor risk assessment + DPA + review

today

informal checklist

with Zulti

written opinion · PSA

LGPD · privacy ROPA, legal basis, appointed DPO

today

website text · no ROPA

with Zulti

program running

Continuous security and technology leadership, no full-time hire.

Book a call →

Frequently asked questions

When there's no CISO or CTO at the table, every CEO asks the same things.

Who answers for security and technology, what gets delivered and how it works with your team.

What's the commercial model: retainer, project or hourly?+

Hybrid. At its core is a recurring monthly fee (what consultancies call a retainer) covering continuous leadership for the seat you hire (security, technology or both), meetings at the agreed frequency, availability for decisions between meetings, and the annual Security and/or Technology Master Plan. Large initiatives that need in-depth work (ISO 27001 adoption, LGPD compliance, post-incident work, an ERP or platform change, assessing a critical vendor) become fixed-scope projects, priced upfront.

Zulti also operates and resells technology. How does that not compromise the impartiality of the CISO and the CTO?+

They're two separate contracts. The CISO or CTO seat is a monthly fee paid directly by the client. Technical operations (Managed Services, Cybersecurity, Cloud) are a different contract, and that's where we operate and resell tools as part of the scope. Recommendations follow what fits your case: if the right tool is in our portfolio, we integrate it; if not, we point you to an outside one, because the seat's pay doesn't depend on the sale. The split is declared at onboarding, with no gray area.

Do I need another Zulti service to get the on-demand CISO or CTO?+

No. Both seats are independent: they work with any company, with or without Zulti's Managed Services or Cybersecurity, with or without an in-house team. When the client is also a Zulti operations client, the monthly fee is lower (part of the environment insight already comes from operations) and the roles stay separate in the scope: operations is operations, leadership is leadership. But starting doesn't require any other contract.

How often do we meet? How many hours per month?+

Agreed case by case. We don't use a fixed "X hours for Y" table, because real demand varies a lot between clients. A company adopting ISO 27001, running an LGPD program or in the middle of a system change needs weekly meetings; a mature environment, monthly. Post-incident work needs intensive presence in the first weeks, then slows down. The monthly fee is sized to the demand pattern and reviewed when it changes. No charge for every email answered.

How is this different from a large consultancy or a compliance audit?+

It's a different role. A consultancy delivers an assessment and recommendations, then leaves. An audit issues its opinion and leaves. The on-demand CISO or CTO takes the seat: they're responsible for leadership between recurring meetings, defend decisions to the board, follow the plan's execution and update the course when things change (a new regulation, an incident in the industry, a new vendor, a new business need). It's an executive role, not an advisory one. That's why billing is recurring monthly, not a one-off project. And that's why the relationship lasts years, not months.

Who it's NOT for

Shared security and technology leadership has limits, and we'll tell you when.

Commercial honesty has kept us going for almost a decade. In some scenarios, another model is a better fit. We list them openly to save you evaluation time.

Your company has technology as its main product (software house, fintech, digital product scale-up). Zulti's on-demand seats are for companies whose business happens outside software. A company that sells software needs a full-time in-house CISO and CTO, inside the product.

Your technical team is already past 10–15 people and the main need is people management (careers, performance, headcount, culture). The on-demand seat serves companies that still need strategic direction more than people leadership. That stage calls for an in-house CTO or technology manager.

You buy IT based on a fixed vendor recommendation or a channel program. At Zulti, technical operations have a defined portfolio and the CISO and CTO seats are paid separately from any sale. But if your company's security and technology decisions are driven by an external channel, this model makes no difference in practice.