NewIs your company ready to put AI to work? Twelve questions, a clear answer.Take the AI Readiness Check →
ServicesVantageComing to Summit clientsIndustriesHow We WorkInsightsAboutContactSchedule a Consultation
HomeHow We Work

How we work

How a Summit engagement runs, from the first call to handover: what happens at each stage, what we need from you, and what you keep at the end.

What this page shows

Stages, playbooks and samples
  • 5stages, first call to handover
  • 5playbooks
  • 4sample deliverables
01Stages

From the first call to handover

The shape is the same from one engagement to the next; the length depends on the scope. You will always know which stage you’re in and what we need from you.

The path, stage by stage

5 stages
1First call2Scope3Discovery and baseline4Analysis and plan5Readout and handover1First call2Scope3Discovery and baseline4Analysis and plan5Readout and handover1First call2Scope3Discovery and baseline4Analysis and plan5Readout and handover

  1. First call

    Stage 01

    A conversation about your situation: what started it, who is asking, and when they need an answer.

    What we need from you30 minutes: a free consultation.

  2. Scope

    Stage 02

    Before a proposal exists, we establish which obligations genuinely apply to you and which do not. You get a written scope, timeline, and fee before any work starts.

    What we need from youA short follow-up. No charge.

  3. Discovery and baseline

    Stage 03

    We review what already exists — policies, prior assessments, system inventories, vendor contracts, insurance applications, and incident history — and validate what’s written against what actually happens.

    What we need from youDocuments, and a few hours of your team’s time. We send every question in advance.

  4. Analysis and plan

    Stage 04

    Findings are mapped control by control, rated for likelihood and business impact, and assigned an owner, an estimated remediation cost, and a realistic effort level.

    What we need from youNothing. This stage is ours.

  5. Readout and handover

    Stage 05

    A live session with your leadership walking through current state, the findings that matter, and a 12-month roadmap. You keep every deliverable, and the underlying workpapers, permanently.

    What we need from youOne meeting with leadership.

After handover

Your team, your MSP, or Summit

After handover, your internal team or your MSP can run the roadmap on its own, or Summit can stay on as your Virtual CISO.

  • Your internal team
  • Your MSP
  • Summit, as your Virtual CISO

02How we work

The path to the summit.

The route up the mountain

Each phase is a stop on the way to the summit.

Know where you standAssess1Build the routeStrategize2Own the climbLead3Show the progressReport4The summit1234

Know where you stand.

Phase 01 · Assess

Evaluate your current security posture, risk exposure, and compliance gaps against the frameworks that matter to your business.

What you get
  • Posture baseline
  • Framework gap analysis
  • Risk register

Build the route.

Phase 02 · Strategize

Build a roadmap and governance structure that fit your risk tolerance, budget, and growth plans.

What you get
  • Prioritized roadmap
  • Budget case
  • Governance model

Own the climb.

Phase 03 · Lead

Run the program as your Virtual CISO: set the priorities, direct the work, and report on the results.

What you get
  • Program leadership
  • Vendor & team oversight
  • Incident readiness

Show the progress.

Phase 04 · Report

Translate progress and risk into clear reporting for your leadership, investors, auditors, and regulators.

What you get
  • Leadership reporting
  • Audit evidence
  • Posture over time

Climb again.

Then

Every cycle raises the baseline. Vantage keeps the record of how far you’ve come.

See the record
03Playbooks

How we’d handle it

Five situations that commonly bring a company to a security advisor, and how Summit would run each one: the first 30 days, the decisions you’d face, and what you’d have at the end.

  1. PlaybookPB-01

    Security Due Diligence Ahead of a Healthcare Add-On

    Private Equity · Pre-Acquisition

    A private equity firm evaluating a healthcare technology add-on needs a clear picture of inherited cyber risk before closing. Summit would run a structured two-week assessment, translate what it finds into deal terms, and set up a 90-day remediation plan for after close.

    4steps
    3decisions
    3deliverables
    ServiceM&A AdvisoryRead the playbook
  2. PlaybookPB-02

    Getting to a Readiness Target Ahead of an Enterprise Contract

    HealthTech · Compliance

    A growing healthcare technology company needs to meet HIPAA obligations to win a major enterprise contract. Acting as Virtual CISO, Summit would build and lead the security program toward its readiness target, on a plan built around a one-quarter deadline.

    5steps
    4decisions
    3deliverables
    ServiceVirtual CISO LeadershipRead the playbook
  3. PlaybookPB-03

    Standing Up Governance Without Slowing the Business

    High-Growth · Governance

    A high-growth financial services firm has outpaced its informal security practices. Stepping in as Virtual CISO, Summit would establish governance, incident response, and leadership reporting structures sized so they don't slow product delivery.

    4steps
    4decisions
    3deliverables
    ServiceVirtual CISO LeadershipRead the playbook
  4. PlaybookPB-04

    Integrating Two Security Programs After Close

    M&A · Post-Close Integration

    An acquirer has closed on a company whose security program has never been assessed. Summit would build an integration plan that sequences the work so customer-facing risk is addressed first, planned around both companies' operations.

    5steps
    4decisions
    3deliverables
    ServiceM&A AdvisoryRead the playbook
  5. PlaybookPB-05

    Putting Governance Around AI Tools Already in Use

    Professional Services · AI Risk

    A professional services firm discovers its teams are using AI tools with client data and no rules. An AI risk assessment and a governance framework mapped to the NIST AI RMF would let the firm decide which tools to keep and answer its clients' questions with evidence.

    4steps
    3decisions
    3deliverables
    ServiceAI Risk & Security AdvisoryRead the playbook
04Samples

What you receive

Deliverables written to be used, not filed. Four samples show the format; the full lists are on the Compliance Assessments and Virtual CISO pages.

Executive summary

Risk & compliance assessment

Four to six pages your CEO and leadership will actually read, stating the posture, the top exposures, and the recommended investment.

Control-by-control findings register

Risk & compliance assessment

Every requirement in scope, its status, the evidence reviewed, and the specific gap.

12-month prioritized roadmap

Risk & compliance assessment

Sequenced initiatives with estimated cost, internal effort, and target completion quarter.

Quarterly leadership briefing

Virtual CISO

A presentation-ready readout for the people who need the summary, not the detail.

Samples show the format only. Example Co. is a fictional company, and every entry is a placeholder, not a finding.

Tell us your situation. We’ll tell you how we’d handle it.

Schedule a ConsultationAsk a Question