Why does it matter if a security advisor also sells tools?
Because the person telling you what you need gets paid when you buy it. That conflict does not make anyone dishonest, but it bends advice toward products and away from cheaper fixes such as process changes, configuration of tools you already own, or simply accepting a low risk. Independent advice is only independent if the advisor earns nothing from your purchases.
This shows up in a few common ways:
- Resale margin. The advisor or MSP earns a markup on licenses or hardware it recommends.
- Vendor incentives. Referral fees, partner tiers, or commissions tied to selling a certain product.
- Grading your own homework. An MSP's in-house "vCISO" reviewing the MSP's own work, and deciding whether to report its gaps to you.
Ask any provider, in writing: "Do you resell anything, or receive anything from any vendor you might recommend to us?" CyberCascadia's answer is no. We sell no products, offer no managed services, resell nothing, and take no vendor commissions. Our fee is the only money we make from you, which means the cheapest fix that works is always the one we recommend.
Signs you have outgrown "the MSP handles security"
You have outgrown it when outside parties start asking for documented security answers, when no one inside the company can explain your security posture without calling the MSP, or when leadership signs things about security they cannot verify. Any one of these means you need a security owner, not just a security vendor.
- A customer security questionnaire is holding up a deal, and your MSP sent back half the answers with "N/A" or "ask the client."
- Your cyber insurance renewal asks about MFA, EDR, backups, and incident response, and the person signing it cannot confirm the answers.
- A contract or BAA arrived with security terms, and nobody is sure what they commit you to.
- An auditor, examiner, or customer assessment left findings, and there is no single owner tracking them.
- Your board, owners, or lenders asked "are we secure?" and the answer was a shrug or a slide of patch percentages.
- You have no written incident response plan, or you have one that no one has practiced.
- Every security recommendation you get comes with a product to buy.
- You are not sure whether your MSP is doing a good job, and you have no way to check.
None of these mean your MSP is bad. They mean you are asking an operations provider to do a leadership job.
How does CyberCascadia work alongside an MSP?
CyberCascadia sits on your side of the table and works with your MSP, not against it. We set priorities, write a remediation plan your MSP can execute, review progress using their reports, and handle the outside documents. Your MSP keeps every system it runs today. We never touch your systems or install anything.
In practice that looks like:
- Interviews, not access. We work from conversations with you and your MSP plus existing documentation. No admin credentials.
- A plan written for the MSP. Each item has an owner and a date, in language a technician can act on.
- Regular check-ins. We review what is done, what is stuck, and what needs a decision from you.
- Outside documents handled. Questionnaires, insurance applications, and contract exhibits are answered accurately, with the MSP confirming technical facts.
- Plain reporting to leadership. What changed, what is at risk, and what you need to decide.
This is what our MSP security oversight service is built around, and it is part of every vCISO engagement.
Why we never compete with your MSP
We do not offer managed services, monitoring, help desk, or tool resale, so there is nothing for us to take from your MSP. We will not recommend you switch providers in order to sell you something, because we have nothing to sell. If a gap is serious, we tell you plainly and give your MSP a fair chance to close it. A clear, prioritized list is usually easier for an MSP to act on than vague requests from a client who is not sure what to ask for.
When do you NOT need a vCISO?
You probably do not need a vCISO if you are very small, hold no regulated or sensitive customer data, have no customers or carriers asking security questions, and have a competent MSP. In that case, spend the money on solid basics through your MSP and revisit the question when an outside party starts asking.
Specifically, a vCISO is likely not worth it yet if:
- You have fewer than about 10 employees and simple IT.
- No customer, partner, insurer, or regulator is asking you security questions.
- You do not handle health, financial, or other regulated data.
- Your MSP already covers the basics: MFA, backups you have tested, endpoint protection, and patching, and can show you evidence.
- You only need a one-time answer. In that case a fixed-fee project fits better than a monthly retainer.
If one document is the only problem, the Ten-Day Answer handles it for a $3,500 fixed fee in 10 business days, with no ongoing commitment. If you want a free first look at insurance readiness, try the cyber insurance readiness checker. And if you want to know what an ongoing vCISO would cost, our vCISO cost guide lists every price.
Where compliance automation platforms fit
Compliance automation platforms, such as Vanta or Drata, automate evidence collection for frameworks like SOC 2. No software decides your scope, writes policies that match how you actually run, or judges which risks matter most. That is leadership work, whatever tools you use. A vCISO does that work and can help you decide whether a platform is worth adding at all.
Common situations by industry
The split between MSP and security leadership looks a little different by industry. Healthcare covered entities and their business associates must identify a security official and conduct an accurate and thorough risk analysis under the HIPAA Security Rule (45 CFR 164.308). Your MSP can supply technical facts, but someone has to own that analysis; see our HIPAA security risk assessment. Financial services firms covered by the FTC Safeguards Rule must designate a Qualified Individual to implement and supervise their information security program, and that person must report in writing, at least annually, to the board or governing body (FTC guidance). Whether a rule applies to you is a legal question; this is not legal advice. Manufacturers face supplier questionnaires from larger customers that ask for policy and governance answers an MSP cannot supply on its own. If you are near Tacoma, Spokane, or North Idaho, we work with your local MSP wherever it is based.