Cybersecurity assessment tool
for vCISO consultants

Why vCISO consultants need a better assessment workflow

The vCISO market is in a structural growth period. Three regulatory frameworks — NIS2 (EU, in force since October 2024), DORA (EU financial services, in force since January 2025), and CMMC 2.0 (US defence supply chain, phased rollout through 2026) — have created sustained demand for cybersecurity readiness assessments. Mid-market and SMB clients who previously treated cybersecurity as an IT problem are now treating it as a board-level compliance obligation, and they're hiring fractional CISOs and boutique security firms to help.

The work is there. The bottleneck is delivery. A typical vCISO engagement starts with an assessment — NIST CSF, ISO 27001 readiness, NIS2 gap analysis, SOC2 readiness — and ends with a written report that maps findings to controls, prioritises remediation, and communicates risk in language a non-technical board will read. Building the assessment in Google Forms or generic survey tools, scoring it manually in Excel, then writing the report in Word and formatting it in InDesign or Canva is a 6-10 hour process per client. For a vCISO running 5-10 client engagements per month, that's 30-100 hours of non-billable work — every month.

How Narratiq fits the vCISO workflow

Narratiq compresses the assessment-to-report workflow into four steps:

1. Define your framework once. Describe your assessment methodology in plain language — NIST CSF, NIS2 controls, CMMC level 2, your custom maturity model. The AI generates the question structure, scoring logic, and dimension weights from your description. You refine the questions to match your specific approach. Setup time per framework: 30-90 minutes.
2. Brand the report template. Upload your firm's logo and colours, choose from executive, detailed, or one-pager layouts, and adjust the section structure if needed. The drag-drop PDF builder handles cover page, headers, footers, and page numbering.
3. Send the assessment to your client. Each engagement gets a shareable link, optionally password-protected and time-limited. Clients fill out the assessment in a branded form on your custom subdomain.
4. Review the AI-generated report. When the client submits, Narratiq scores every dimension, generates radar and bar charts, and writes a structured first draft of the executive summary, dimension-by-dimension analysis, and prioritised remediation recommendations — all grounded in that specific client's scores. You review, adjust the parts that need your direct expertise from the discovery conversations, and the branded PDF is ready in 20 minutes.

Frameworks Narratiq is being used for

What the AI actually writes — and what it doesn't

Narratiq's AI is built to draft the structural writing of a cybersecurity assessment report — the parts that follow the same rhythm engagement after engagement. Specifically:

• Executive summary. A 2-3 paragraph overview written for a non-technical board audience, summarising the client's overall maturity score, top three priority gaps, and recommended next steps. Grounded in the specific client's scores, not a generic template.
• Dimension-by-dimension analysis. For each control category (Identify, Protect, Detect, Respond, Recover in NIST CSF; or the equivalent dimensions in your chosen framework), the AI writes an interpretation of the score, what it means in practice, and where the gaps are concentrated.
• Prioritised recommendations. Specific remediation actions ranked by impact and effort, written in the language of your framework, with the rationale for prioritisation.

What the AI does not do — and shouldn't:

• Make compliance assertions. The AI writes about gaps, scores, and recommendations. It does not assert compliance with any standard. That assertion is the consultant's professional judgement, after review.
• Replace your client conversations. The AI sees the assessment scores. It doesn't see what the client told you in the discovery call about budget constraints, internal politics, or the recent breach they're still recovering from. Those contextual observations are added by the consultant during review — that's the 10-20% of the report that your professional voice owns.
• Replace technical depth where it matters. For deeply technical sections (specific control implementations, network architecture analysis, detailed remediation playbooks), the AI's output is a structural starting point. The consultant's domain expertise is what makes those sections genuinely valuable.

What the workflow looks like in practice

Consider a fractional CISO running NIS2 gap assessments for mid-market manufacturing clients in the EU. The previous workflow looked like this: build the assessment in a survey tool (3 hours per framework), score the responses in Excel after each client (1 hour), write the executive summary, the per-section analysis, and the remediation roadmap in Word (4 hours), format and brand the document (1 hour). Per client: 9 hours of non-billable work.

With Narratiq, the same vCISO defines the NIS2 framework once — typically 60-90 minutes for the first build. Every subsequent client uses the same framework. When a client submits, the AI scores every dimension, generates the maturity radar chart, and writes the first draft of the executive summary, the section-by-section narrative, and the prioritised remediation roadmap. The vCISO reviews, adds the contextual observations from discovery calls (the recent ransomware incident at a peer company that's driving the client's urgency, the fact that their CFO is the de-facto security sponsor because there's no formal IT function), and the branded PDF is ready in 20-30 minutes.

Across 8 client engagements per month, the workflow recovers approximately 60 hours per month — time that goes back into client conversations, business development, or genuinely off the clock.

Pricing for vCISO practices

Narratiq's plans map directly to typical vCISO practice sizes:

• Solo — $149/mo. One consultant, up to 10 active client engagements, 100 AI generations per month. Fits a fractional CISO with a steady book of 5-10 mid-market clients.
• Pro — $249/mo. Three consultants, 25 active engagements, 300 AI generations, custom subdomain and full white-labelling. Fits a small boutique security firm with two or three senior consultants.
• Agency — $449/mo. Unlimited users, unlimited engagements, unlimited AI generations, sub-account support. Fits a growing security consulting firm with multiple practice leads and a need to manage client engagements across teams.

All plans include AI-written narrative, drag-drop PDF builder, custom branding, conditional content, weighted scoring, and the full assessment builder. There is no feature-gated AI tier and no custom-priced enterprise contract for the core report-writing workflow.

Frequently asked questions