Contractor cuts internal critical vulnerabilities from 76 to 12 with a fractional CISO and a one-page dashboard
A growing low-voltage systems design-build contractor. Outcome verified
76 to 12
The problem
A growing low-voltage systems design-build contractor came out of its first security assessment with 19 ranked gaps and nobody to drive them. It had a small technical team, an outsourced infrastructure provider, no security leader and no budget for a full-time CISO, so every improvement had to be a small project the team could absorb.
Why it mattered
Customer security questionnaires arrived with no good answers, nothing watched for suspicious activity, and a phishing test had shown employees would give up credentials.
What we did
Vizius installed a fractional CISO who turned the roadmap into eleven costed mini-projects leadership could choose to fund, and reported monthly on a one-page dashboard with four numbers: critical vulnerabilities inside and out, phishing results and compromised credentials. When phishing training plateaued, the program shifted from testing people to protecting them with AI mailbox screening.
What changed
Over 22 months internal critical vulnerabilities fell from 76 across 25 hosts to 12, external criticals held at zero, and phishing credential-sharing fell from 9 to 1. A SIEM was live, five phishing campaigns had run, and mailbox screening was classifying over a hundred suspicious emails a week, about fifteen needing a human.
- Construction and engineering
- Midsize company
- CIS Controls