The stack · Open-source CISO office
A virtual team of purpose-built AI agents covering the full lifecycle of the role. Each one designed by a working CISO, grounded in real procedure, evidenced end-to-end. This is the stack — what shipped, what's in flight, what's still on paper. Building in public.
The virtual team
Not one general assistant pretending to be everything. A team of specialists, each one with a job description, a scope of authority, and a probe surface that proves it did the thing it claims to have done.
Watches the signal across the estate. Enriches new findings with asset context, exposure, business impact. Keeps the risk register live — not a quarterly artifact. Sizes exposure before anyone asks.
Runs the standard operating procedures end-to-end. Pulls the evidence each control needs, files it where the audit will find it, flags drift before it becomes a finding. SOPs are finally the unit of trust.
Runs third-party assessments against the catalogue. Knows what we accept and what we don't. Maps each vendor to the controls they touch and the data they see. Surfaces the contracts that age into risk.
First responder to alerts. Classifies, correlates, assembles the timeline, hands off to humans cleanly when the call has to be human. No dropped context, no rebuilding the story at 2 AM.
Looks at the office through the auditor's lens. Surfaces gaps before the external party does. Packages evidence the way it's actually going to be read — not the way we wish it would be.
Turns operational state into business language. Composes the narrative of safety, evidenced — not a list of activity, not a heat map. The interface that lets the business feel where it stands and decide what to spend.
How the agents are built
Four properties every agent in the stack has to have. Each one throws away most of the implementations we could otherwise reach for — that's the point.
Coverage
Every layer the role has to cover — and where in the stack the work lives. Some layers are deep, some are stubs today. The point is the map isn't a marketing fiction; it's the actual scope of the role, written down.
The wager
We offload the work no human should be doing twice — and free the human to do the work no machine can. The office gets faster, the CISO gets their job back.
Subscribe — free, forever
One email a week from inside the CISO office stack — what shipped, what broke, what the agents got wrong, what's worth your Monday morning. About ten minutes. Unsubscribe in one click.
free · unsubscribe anytime · gdpr-friendly