Meet NIS-2, DORA, ISO 27001. With a CISO you don't have to hire.
Cybervize takes on the CISO function in two ways. As a Virtual CISO permanently, with a fixed capacity of two to six days per month, from 3,600 euros per month. As an Interim CISO for a fixed term, when the role is vacant or an incident has to be worked through; that route is priced per engagement. Alongside it the ISMS platform OdySecure for IT and OT, from mid-market to enterprise: ISMS, BCM, Assessment and Third-Party Risk Management with security assessments against ISO 27001, IEC 62443, IT-Grundschutz, NIST or your own standards. AI under your own control, data residency in Germany.
We take on the CISO function. Interim until the role is filled, or permanently. As a vCISO from €3,600 per month.
Intro call: free, 30 minutes, with a senior CISO.
References
- Moonfare: Cybervize as Interim CISO for the DORA implementation and the ISO 27001 audit
- Support with the introduction of NIS-2 in the energy sector
- Carve-out as Interim CISO: building up information security at an international mechanical engineering company
- Support for several acquisitions with M&A cybersecurity assessments for an insurance company
Monthly report
Example
Information security
To the management board
Overall status: On track. One decision is open.
1 Status of requirements
| Status light | Requirement | Status | Implementation in per cent |
|---|---|---|---|
| amber | NIS-2 | in progress | 72 % |
| green | ISO 27001 | audit-ready | 91 % |
| amber | Supplier questionnaires | 11 of 14 | 79 % |
2 Situation
- Risks above tolerance
- 3
- Next audit
- in 6 weeks
3 For decision
Residual risk, legacy accounting system
- accept until Q1
- bring replacement forward
Your vCISO
Evidence in OdySecure
Page 1
Memberships, programmes and partnerships
The CISO function, filled.
A senior CISO takes on the role in your organisation and leads your NIS-2, DORA or ISO 27001 work until it can be evidenced.
A filled function
We carry out the work and keep your executive board informed (C-level reporting).
Evidence in OdySecure
The work runs on our platform. The licence is included in the mandate.
Support through audits
We prepare audits and inspections with you and support you on the day.
- Basicfrom €3,600 a month, approx. 2 days
- Standard€4,900 a month
- Seniorapprox. €8,500 a month, 5 to 6 days
Minimum term 6 months, then cancellable monthly.
What each tier includes- Regulatory requirementsNIS-2, DORA or ISO 27001 must be met and evidenced. vCISO
- VacancyYour CISO post is open. An interim CISO bridges the gap for a fixed term, project-based at €8,000 to €15,000 a month. Interim CISO
- Acquisition or carve-outAfter closing, build the security function in the acquired company or in the carved-out unit. M&A support
Your vCISO works with OdySecure.
Your vCISO runs your information security management system in OdySecure, our own platform. The requirements that apply to your organisation, for example from NIS-2, DORA or ISO 27001, sit there alongside risks, measures and evidence in a single data set. That is why evidence is produced in day-to-day operations rather than in the days before the audit, and why the monthly report to your management board comes from the same data. The platform is included in the mandate. Cybervize developed it from its own consulting practice, funded by the German federal government's StartupSecure programme and in a 14-month partnership with the CISPA incubator, the Helmholtz Center for Information Security.
Two routes, one firm
The vCISO mandate fills your CISO role and implements the regulatory requirements your organisation faces, with OdySecure as our tool. If the role is already filled on your side, license the platform on its own. Both run on the same data foundation, are operated in Germany and stay under your control.
Virtual CISO
We fill your CISO role part-time and remotely, on a long-term basis. The platform is included in the mandate and carries the evidence.
- Mid-market companies without full-time CISO budget
- Continuous NIS-2 or ISO 27001 compliance management
- Strategic partner instead of one-time project consultant
2 to 6 days/month | From €3,600/month, platform included
See the vCISOPlatform licence
Your CISO is on board and you need the tool. Module licence, with an onboarding project on request, then ongoing operation by your internal team.
- In-house CISO function already established
- Replace Excel and Word ISMS, build an audit trail
- Migration from an existing GRC suite
Module licence | Migration 6 to 10 weeks | Onboarding to self-service 6 to 12 months
See the platformVacancy or crisis? An Interim CISO takes over for 3 to 12 months, on-site if needed. Go to Interim CISO
Only need to know whether NIS-2 applies?
In the risk check we establish in 30 minutes whether NIS-2 applies to your company and which five gaps matter most. Free and without obligation.
Book the risk check The journey in 5 stationsLooking for cybersecurity for mid-market companies? That page brings vCISO, NIS-2, ISO 27001 and our other services together.
We call the model behind it the ISMS operating system: requirements, risks, measures and evidence come together in one connected data model. Compliance is created in operations, not next to them.
OdySecure
OdySecure amplifies the effectiveness of your security lead or team. ISMS, risk management, assessments, BCM and third-party risk management in one system. With built-in LLMs, Made in Germany.
Discover the platform
Everything in one place
No switching between tools. From assessment gaps you create measures with one click, BIA data validates BCM plans, supplier risks link to assets.
AI as a teammate
Integrated LLM service assists with risk assessment, contract analysis and assessment summaries. Hosting exclusively in Germany.
What the AI takes over
You do not fill in an ISMS. You feed it your documents.
OdySecure derives what applies in your organisation from your documents and your structure: from business process to security process, each station a proposal a human accepts. Under a vCISO mandate, your vCISO does this for you.
- 1Business process
- 2Asset
- 3Risk
- 4Measure
- 5Control
- 6Policy
- 7Security process
A human decides at every station. The AI proposes; you accept the proposals one by one or per station, and each approval records who signed it off.
Where do we stand? Sourced answers instead of gut feeling.
The AI that names its sources and says no when data or read permission is missing. Questions are logged for audit.
Management teams, supervisory boards and auditors all ask the same question. The AI layer of OdySecure answers it from your real data, not from assumptions.
OdySecure Navigator: sourced answers
AvailableThe assistant answers questions like "What are our biggest risks?" or "Are we audit-ready?" from your tenant's real data: around 25 vetted queries, every answer with source and metric, strictly within read permissions. If there is no data or no read permission, it says exactly that. Read-only is the deliberate limit of the answer: it never acts on its own. It prepares actions; only your confirmation triggers them.
AI agents: acting with approval
Design-partner programmeAI as an employee: its own account, roles, a visible AI-agent badge. Suggesting is the default; acting is limited to narrowly defined fields and requires four-eyes approval. Hard locks always apply: no closing incidents, no risk acceptance, no approvals, no granting of rights. First use case: initial incident triage with indicative NIS-2 deadline hints.
Sovereign in operation, humans stay accountable
This is how the AI layer is built (OdySecure Navigator available, AI agents in a design-partner programme, not yet generally available):
- Sovereign mode: local LLM operated in Germany, no data passed to external model providers.
- AI system inventory: every agent is added automatically; a human classifies and confirms before activation. This is your own record, not a filing with any authority.
- Human in the loop: a kill switch pauses any agent instantly, access keys expire at the term set for them, actions are in the audit log.
Ask first, then act, always verifiable.
Client voice
“Alexander Busse supported us with Cybervize as Interim CISO in the DORA implementation and the ISO 27001 audit. We achieved both.”
Talk to us about your CISO function.
In the intro call we establish which requirements apply to your organisation and how we would fill the CISO role. Free, 30 minutes, with a Senior CISO.
Book an intro callThe Cybervize Podcast
Cybersecurity insights: Interviews with CISOs from Vodafone, Red Bull, Trade Republic and more.
Cybervize Podcast on Spotify
Spotify sets cookies. By clicking you consent to data transfer to Spotify.
Latest from our Blog
Practical insights on cybersecurity, NIS2, AI governance and CISO strategies.
Why AI-run attacks usher in the golden age of cybersecurity
In July 2026 a swarm of AI agents compromised the platform Hugging Face, with no human direction of the attack, according to METR. Why we see exactly that as the start of cybersecurity's best decade.
25 years of ISMS practice, cast into software
The cyber security market is full of promises. What separates substance from marketing is a track record you cannot fake. Why we turned 25 years of audit and implementation practice into a platform, not the other way around.
Provider Pricing Power Is the New Lock-in: What AI Model Monetisation Means for Your Budget
A model's price is an annoyance. The dependency behind it is a business risk. Provider pricing power is the new lock-in, and the ability to switch is the real question of sovereignty.
Working with Cybervize: three routes
IT service providers and MSSPs serve their clients in separate tenants in OdySecure, with their logo in the reports. Consulting firms run assessments and advisory engagements on the platform. Freelance vCISOs lead mandates that Cybervize wins, with OdySecure as their tool.
Become a partner