Service · Monthly · Retainer
Senior application security judgement, without a full-time hire
After an assessment, I stay on a monthly retainer to keep the roadmap moving, review designs and vendors, and help when something urgent lands.
- Monthly
- Retainer
- OWASP SAMM v2
- NIST CSF 2.0
In short
A fractional application security (AppSec) advisor is a senior specialist on a monthly retainer who works as part of your team without a full-time hire. After an assessment, I govern the roadmap with your sponsor, review designs, vendors and contracts, join the change and risk forums that matter, and give escalation support during incidents. Hours and response times are agreed up front.
This is for you if
- An assessment produced a roadmap and nobody senior owns it day to day
- The security team is strong on infrastructure, thin on applications
- Vendors and integrators need someone who can challenge their designs
- A full-time AppSec lead is not justified yet, or is hard to hire
When to call me
The moments this engagement is built for.
- 01The roadmap stallsInitiatives slip once the assessment team leaves, and quarterly reviews keep getting postponed.
- 02A major vendor selectionYou are choosing a WAAP, scanner or core platform and want independent questions asked before signing.
- 03An incident needs senior judgementAn attack or audit finding needs someone who has handled one before, quickly.
- 04Between security leadersThe CISO or AppSec lead role is vacant, and decisions cannot wait for the hire.
How it runs · Monthly
From kick-off to a plan you can act on.
- 01Onboarding
- Agree priorities, hours and response times
- Meet the owner of each roadmap initiative
- 02Roadmap governance
- Monthly check-in with initiative owners
- Quarterly progress review with the sponsor
- 03Design and vendor reviews
- Review designs and changes before they ship
- Challenge vendor proposals and contract terms
- Escalation support within agreed response times
- 04Reassessment
- Re-score maturity with the same scope and method
- Reset the roadmap for the next year
What you get
Deliverables, not a slide deck of opinions.
- SpreadsheetRoadmap trackerInitiative status, owners, blockers and decisions, kept current every month.
- PDF reportQuarterly sponsor reportProgress against the roadmap, new risks and the decisions needed, on one page.
- Review notesDesign and vendor reviewsWritten opinions on designs, vendor proposals and contract terms before you commit.
- On callEscalation supportDirect access for incidents, audit findings and urgent decisions, within agreed response times.
- PDF reportAnnual reassessmentMaturity re-scored with the same scope and method, so progress is measured, not claimed.
What happens next
Afterwards, you can decide.
An assessment is only useful if it changes a decision. These are the ones this engagement is designed to unlock.
- 1Which initiatives to accelerate, pause or drop each quarter
- 2Whether and when to hire a full-time AppSec lead
- 3Which vendors and designs to approve, and on what conditions
- 4When to scale the retainer up, down or end it
- 01
Assess
I audit your applications and the security you already have, across six areas. Evidence, not questionnaires.
- Findings with evidence
- Score per area
1–4 weeks
- 02
Recommend
A prioritised plan: what to fix first, what it costs, and what risk it removes.
- 30/90/365-day plan
- Board summary
With the assessment
- 03
Execute, case by case
If you want help delivering, I scope it by expertise, manpower and timeline. Your team, a partner or Innov8.
- Delivery options
- Independent oversight
Only where it makes sense
Method
Built on standards your auditors recognise.
- OWASP SAMM v2
- NIST CSF 2.0
Grounded in delivery
Where this experience comes from.
What is a fractional AppSec advisor?
A fractional application security (AppSec) advisor is a senior specialist who works part time on a monthly retainer, acting as part of your team rather than as an outside auditor. The role usually covers roadmap governance, design and vendor reviews, and escalation support. It gives you senior judgement without a full-time hire, and it can scale down as your own team grows.
Is this the same as a virtual CISO?
No. A virtual CISO (chief information security officer) covers the whole security programme: infrastructure, identity, policy, compliance and more. This retainer is narrower and deeper. It focuses on application security: edge and API (application programming interface) protection, testing and exposure, monitoring of application attacks, mobile apps and governance. It works alongside your CISO, not instead of one.
Do we need an assessment before the retainer starts?
Usually, yes. A retainer works best when there is a roadmap to govern, so most start after a maturity assessment or a focused assessment. If you already have a recent, evidence-based roadmap from another provider, I review it during onboarding and work from it rather than repeat the assessment. Without either, the first months become an assessment anyway.
How are the hours and response times agreed?
Up front, in the retainer. We agree a monthly allowance of hours, the meetings I attend, the response time for normal requests and for urgent escalations, and how extra hours are handled. Scope and allowance are reviewed every quarter with the sponsor, so the retainer follows the roadmap rather than a fixed menu of services.
Does the retainer include implementation work?
No. The retainer is advice and oversight. When a roadmap item needs hands-on delivery, it is scoped separately, case by case, based on the expertise and manpower required. Your own team, a partner of your choice or Innov8’s Application Security Business Unit, which I head and always disclose, can deliver it, and I can provide independent oversight of whoever does.
Other engagements
- AppSec maturity assessmentScored baseline, gap analysis, 12–24 month roadmap, board summary
- Application architecture reviewThreat model, control coverage map, prioritised fixes
- WAAP & API protection assessmentCoverage gaps, bypass paths, migration or tuning plan
- Mobile app security assessmentMobile threat model, protection policy, MASVS test plan
- Exposure management (CTEM) assessmentPrioritisation model, validation approach, owner playbook, metrics
- Executive briefing or team workshopPlain-language risk briefing or hands-on workshop