Not a consultant.
A consultant advises. A vCAIO accepts executive accountability for the AI agenda, drives decisions and reports to leadership and the board.
Executive Advisory / Fractional Executives / Virtual Chief AI Officer
The executive who ownsAI strategy, governanceand return, without thepermanent C-suite hire.
Your Virtual Chief AI Officer (vCAIO) leads AI governance, risk ownership and executive reporting. We connect policy and accountability with the technical work your AI systems need.
Need broader enterprise security leadership? Our vCISO service provides accountable security strategy, risk, compliance and board leadership. Explore vCISO →
Led by the author of The CISO's AI Firewall · ISO/IEC 27001 Lead Auditor · Senior-led delivery on every engagement
Steve Sharma, Founder & Principal
Principal Cybersecurity Architect with 18+ years across government, defence, four major banks, telecommunications and critical infrastructure. Author of six books on AI security, identity and governance, including The CISO's AI Firewall.
Author, The CISO's AI Firewall· Founder & Principal, Cybersecurity Link
We work with
ISO/IEC 42001NIST AI RMFEU AI ActOWASP LLM Top 10
The short version
01
What it is
A senior executive, appointed on a fractional basis, who owns your AI strategy, governance, risk, security and board reporting.
02
Who it's for
Organisations with AI in use and nobody accountable for it. Typically 200 to 5,000 people, or any regulated or government entity.
03
What it costs
A fixed monthly fee, confirmed in writing after scoping, instead of a permanent C-suite salary. Indicative fees are shared on request.
04
How it starts
The 90-Day AI Leadership Gate, with outcomes agreed in writing before we begin.
05
How you stop
At day 90 you continue, change scope, or stop. No exit fee, no notice period on that decision.
06
Why us
We govern AI and secure it, and we provide a vCISO alongside the vCAIO. Led by the author of The CISO's AI Firewall.
Your board approved the investment.Did anyone set the governance expectation?
StuckThe pilots stall
Pilots produce demos but not the business value that justified them, and nobody owns the decision to scale them or stop them.
VetoThe CFO stops believing
AI projects get approved on ROI projections that nobody measures after launch. Finance stops sponsoring and starts saying no.
DriftThe board approved, then moved on
The board approves major AI investment and moves on. Governance expectations go unset, and AI risk never reaches a standing agenda.
69%Staff are already using it
Organisations that suspect or have evidence of staff using prohibited public GenAI tools. If nobody owns AI, nobody knows which tools those are or what data they touch.
Source: Gartner survey of 302 cybersecurity leaders, March to May 2025.AI doesn't need another project manager. It needs an accountable executive.
Cybersecurity Link provides fractional AI leadership across strategy, governance, risk, security and board reporting, connecting AI ambition to accountable execution.
Definition / 06
What a Virtual Chief AI Officer actually is
A Virtual Chief AI Officer (vCAIO) is a senior executive appointed on a fractional basis to provide accountable leadership across AI strategy, governance, risk, security and board reporting, with the authority to decide what gets built, what gets stopped and what gets governed. The role complements your existing leadership team without a permanent C-suite appointment. Unlike a consultant, a vCAIO holds the accountability rather than advising on it.
And what it isn't
Not your CTO's second job.
Giving AI accountability to your CTO dilutes their focus and still leaves the specialist gap. They should be your closest partner, not your AI owner.
Not an implementation partner.
We don't fine-tune models, write pipelines or configure your data platform. We decide what gets built and hold whoever builds it to standard.
Not a governance platform.
Software produces a dashboard. A dashboard cannot chair your AI forum or answer for a decision.
Not an AI vendor.
We sell no models and resell no third-party licences or seats. Our own platform, AISF, is never a condition of an engagement and never a finding in our own assessments.
Accountability / 07
What your vCAIO owns
This role sits alongside your CIO, CTO and CISO, not above them. If you already have a security or technology leader, this is the person who takes AI off their plate and gives them back their day job. If they would rather keep AI and want executive backup instead, that works too. We'll say which we think fits on the call.
Standing mandate
The AI strategy, roadmap and governance model, re-cut as the market moves
Which use cases get funded, and which get stopped
Your AI governance forum: chaired, minuted, decisions recorded
The AI inventory: what you're running, who owns it, what it touches
Model, vendor and third-party AI risk, including the AI inside software you already bought
AI security controls: tested, not assumed
Board and executive reporting on progress and return
Regulatory position across the frameworks that apply to you
Evidence artefact
AI inventory & risk register
Governance framework & policy set
Prioritised use-case roadmap with ROI model
Board reporting pack
Conformity and readiness evidence
Two costs your CFO will weigh
Qualitative comparison01 // THE HIRE
Full-time compensationC-suite level
Paid in full, whatever the workload.
Benefits, equity, feesExtra
Time to hireMany months
02 // THE STATUS QUO
AI pilots with nobody to scale or stop themStuck
Hidden AI spend?
AI cost sits in seat licences, usage fees and features inside software you already bought. Until someone counts it, nobody knows the total.
A permanent Chief AI Officer means a full-time salary and a new standing function. We give you senior ownership from day one, and a governance system your team ends up running.
Comparison is qualitative. Your fee is confirmed in writing after scoping.
What this costs, and how you stop
Engagement fees are scoped according to organisational size, regulatory exposure, mandate and reporting requirements.
Put an AI owner in place
Final monthly fee confirmed after scopingUp to 2 days per month. A named executive and a monthly board-ready report.
Request indicative feesGovern the AI already in use
Final monthly fee confirmed after scopingUp to 4 days per month. Adds the risk register, committee attendance and vendor or AI use-case reviews.
Request indicative feesTake the AI executive seat
Final monthly fee confirmed after scopingScoped in discovery. Adds an executive seat, board attendance and business-hours incident on-call support, within the limits set in the proposal. No 24/7 SOC service.
Request indicative feesWhat moves the price
- System count:Production, third-party and embedded AI systems.
- Product vs. operations:Whether AI sits in your product or operations.
- Regulatory exposure:Regulatory exposure and regimes in scope.
- Reporting cadence:Board reporting cadence and whether we attend.
How we quote
01. Scoping conversation
A short scoping conversation, with no charge and no obligation.
02. Written proposal
A written proposal naming your executives, your scope and your fee.
03. Final monthly fee confirmed after scoping
Final monthly fee confirmed after scoping. No hourly billing, and no change orders for work inside the agreed scope.
Final fixed fee confirmed in writing after scoping.
Request an indicative scope90Days
Proof or pause at day 90.
Every engagement runs to the 90-Day AI Leadership Gate, with outcomes agreed in writing before we start. At day 90 you decide: continue, change scope, or stop.
We do this because many organisations reading this have already funded AI work that didn't deliver. You shouldn't have to take our word for it either.
Day 1Outcomes agreed
Day 90Decision
At day 90
Continue
Change scope
Stop
No notice periodNo exit feeNo argument
The five ways organisations try to solve this
Select a column to compare it with us.
| The question you'd ask | Full-time CAIO | Give it to your CTO | AI consultancy | Governance platform | Cybersecurity Link |
|---|---|---|---|---|---|
| Time to start | Months | Immediate | Weeks | Days | Days |
| Owns the outcome | Yes | In addition to their day job | No, advises | No, reports | Yes, named |
| Cost | Full salary | Hidden: their focus | Project fees | Licence + services | Scoped fee, shared on request |
| Can secure the AI, not just govern it | Depends on the hire | Rarely | Rarely | No | Yes, both |
| Independent of AI vendors | Yes | Yes | Often partnered | Is the vendor | Yes, contractually |
| Builds your internal capability | Yes | No | Rarely | No | Yes, that's graduation |
| Hands-on model and pipeline work | Yes | Yes | Yes | N/A | No: we direct, others build |
We put the last row in ourselves. A vCAIO decides what gets built and holds it to standard. The building is a separate job, and we'll tell you who should do it.
Three engagement models
Each solves a different problem. The tier describes your situation, not the quality of the service. You can move between tiers as your AI exposure and internal capability change.
EstablishMost common
Closest fit so far“We have AI everywhere and nobody owns it.”
You may be here if: tick what applies
What's included:
- Up to 2 days per month. A named executive and a monthly board-ready report.
Not included: model development, platform engineering, certification audit
See what Establish costsGovernMost common
Closest fit so far“We have to prove it's governed.”
You may be here if: tick what applies
What's included:
- Up to 4 days per month. Adds the risk register, committee attendance and vendor or AI use-case reviews.
Not included: the certification audit itself, 24/7 monitoring
See what Govern costsLeadMost common
Closest fit so far“AI is core to what we sell.”
You may be here if: tick what applies
What's included:
- Scoped in discovery. Adds an executive seat, board attendance and business-hours incident on-call support, within the limits set in the proposal. No 24/7 SOC service.
Not included: model development; assessment of systems we advise on
See what Lead costsNot sure which one fits? We'll help you work out which engagement suits your situation. If the honest answer is a full-time hire, we'll tell you that too.
Request an indicative scopeTHE TEAM
Your named executive.
Not a capability statement. A named person. Your proposal names your executive before you sign anything.
Founder & PrincipalSteve Sharma
IRAPCISSPCREST
18+ years across four major banks, defence and government. Author, The CISO's AI Firewall.
Cybersecurity DirectorManju Sharma
CISMISO 27001Risk
15+ years leading enterprise risk, governance and compliance programmes across government and regulated sectors.
HR & Admin DirectorSanjeev Kumar
PeopleOperationsCompliance
15+ years overseeing strategic talent management, workforce operations and administrative governance for technology enterprises.
COO India OperationsParas Sharma
OperationsDeliveryAgile
12+ years driving offshore service delivery, operational scaling and cross-border security engineering operations.
Cybersecurity DirectorMansee Sharma
ISO 42001NIST AICloud
Specialist in emerging tech security, AI governance frameworks and cloud security architecture for modern enterprise environments.
Every engagement is assigned a named senior executive before the engagement begins. Where additional specialists are required, they are identified in the proposal and subject to client approval.See leadership and credentials
Why an AI executive should come from security
Because AI governance is a management-system discipline, the EU AI Act sets cybersecurity requirements for high-risk systems, and unapproved AI use is a security exposure as well as a governance gap. Three answers you can check yourself.
ISO/IEC 42001 is an AI management system standard.
ISO/IEC 42001 shares its management-system structure with ISO/IEC 27001: leadership, internal audit, management review and corrective action. Our founder is an ISO/IEC 27001 Lead Auditor.
ISO/IEC 42001:2023 · ISO/IEC 27001:2022The EU AI Act requires cybersecurity for high-risk AI systems.
Article 15 sets accuracy and cybersecurity requirements for high-risk AI systems. Where it applies to your system and role, meeting it takes security testing, not policy alone.
EU AI Act · Art. 15Unapproved AI use is a security and governance problem.
A substantial proportion of executives report concerns about data exposure through unapproved AI use. Shared agent packages have performed data exfiltration and prompt injection without users noticing. Shadow AI is a governance problem and a security incident. Firms that only write policy find out about the second one late.
Governing AI without being able to secure it is half an answer. We do both, and we codified the approach in The CISO's AI Firewall: a practical executive framework for securing, governing and deploying enterprise AI. The method behind our AI leadership:
- ASSESS
- GOVERN
- DEFEND
- MONITOR
- IMPROVE
The first 90 days
We call it the 90-Day AI Leadership Gate. The first 90 days establish the initial operating position, with outcomes agreed in writing before we begin. It's the part you can hold us to first.
1
Map2
Govern3
Prioritise4
Prove5
AssureMap: AI inventory + risk position
By day 30
Govern: operating model + controls
By day 60
Prove, then decide
By day 90
How the gate actually works
- Before we start, we agree the 90-day outcomes in writing: specific, dated and measurable. They go in the engagement letter, not a slide.
- At day 90 we present against them. Not a status update: a scorecard against what we said.
- You continue, change scope, or stop. If you stop, there's no notice period on that decision and no exit fee. We hand over everything we've built.
What we need from you
Access to systems, policies and people using AI, a sponsor who can unblock decisions, and a few hours each month for interviews and review. We write every required document.
And what happens after 90 days
Governance moves from establishment to operation and assurance as your team takes over. We stay only at the level you still need. The intended outcome is that you graduate to a lower tier.
15 // FRAMEWORKS
Which framework should you actually start with?
They do different jobs: values, risk management, a management system, legal obligation and technical security. Here's how they fit together.
If you already operate an ISO 27001 management system, existing governance, documentation and improvement processes may provide a strong foundation for ISO/IEC 42001. If your exposure is mostly US, start with NIST AI RMF. Where the EU AI Act applies, its obligations set your floor wherever you start.
Standards and obligations we work with
ISO
ISO/IEC 42001INTL
AI management system
NIST
NIST AI RMFUS
Voluntary framework
OWASP
OWASP LLM Top 10INTL
LLM security resource
EU
EU AI ActEU
Role-based obligations
AU
AU Voluntary AI Safety StandardAU
National guidance
SG
Singapore Model AI GovernanceSG
Risk-proportional oversight
SR
SR 26-2 model riskUS BANKING
Supervisory model governance
IN
DPDPIN
Data protection obligations
What your auditor or regulator actually receives
AI system inventory with named owners per system
Risk assessments mapped to the applicable framework's control set
Governance forum minutes and decision records
Policy set with version history and review dates
Control test results, including AI security testing
Conformity or readiness documentation, dated and traceable
Financial servicesInsuranceHealthcareGovernment & agenciesCritical infrastructureTechnology & SaaSProfessional services
Where your obligations fall outside this list we'll tell you, and where they turn on legal interpretation we work alongside your counsel.
Want to see what yourfirst 90 days would look like?
A senior executive takes the call. If a full-time hire is the right answer for you, we'll say so on that call.
Cybersecurity Link engagements
What changed
Insurance renewal readiness
Controls that existed only in people's heads were documented and evidenced to the standard an underwriter expects, in time for the insurance renewal.
Audit remediation
After the security leader left, an interim executive was in place. Open audit findings were given owners and moved into a structured, funded remediation programme.
Certification readiness
AI was already in three products with no governance. We put an accountable owner, policy and controls in place and prepared the business for certification.
Client details are withheld for confidentiality. These Cybersecurity Link engagements are anonymised by sector.
19 // TERMS
The commercial terms, up front
The proposal confirms the mandate, deliverables, responsibilities, fee and engagement terms.
Every engagement is delivered by Cybersecurity Link's own named senior executives. Where a specialist skill is needed, it is identified in the proposal and subject to your approval.
Where we draw the line
0AI products or licences sold
0AI vendor partnerships or commissions
100%of recommendations with no financial interest
Product-neutral advisory AISF is never a condition of an advisory engagement.
Our delivery Every engagement is delivered by Cybersecurity Link's own named senior executives. Where a specialist skill is needed, it is identified in the proposal and subject to your approval.
Independence boundary On any system, we either advise or assess. Never both. If Cybersecurity Link or our AISF platform has helped design, document, implement or protect a system, our IRAP Assessor will not assess it, and we will refer you to another ASD-endorsed IRAP Assessor. Where we assess, we do not sell advisory work or AISF into that scope.
Certification We prepare organisations for certification. An accredited certification body conducts the certification audit.
Legal advice We provide security advisory and governance architecture, not legal advice.
What often comes next
Your team learns what we practise
Capability layerIncluded in
Govern and Lead, where scoped.
What's taught
Everything we do.
Why
So your people can run what we build.
A Virtual CISO
Security layerNeed broader enterprise security leadership? Our vCISO service provides accountable security strategy, risk, compliance and board leadership. AI risk and cyber risk are one board conversation, so we provide both executives, cross-briefed under one contract and one governance architecture.
One governance architectureAI risk and cyber risk sit under the same board conversation and the same framework.
Cross-briefed, one contractBoth executives briefed together, so the two aren't governed in separate silos.
Published work
Read Steve Sharma's six books on security, AI governance, identity and DevSecOps.
The CISO's AI Firewall
A practical executive framework for securing, governing and deploying enterprise AI.
View on Amazon
Azure DevSecOps in the Age of AI
Designing, securing and operating intelligent systems with Azure, GitHub and AI agents.
View on Amazon
Identity and Access Management in the Age of AI
Governing human, machine and agentic identities in a Zero Trust environment.
View on Amazon
23 // FAQ
Questions we get asked
We lead your AI agenda because AI governance and AI security are one problem. ISO/IEC 42001 uses the same management-system structure as ISO/IEC 27001. Our founder is an ISO/IEC 27001 Lead Auditor. Where the EU AI Act applies, high-risk systems must meet cybersecurity requirements.
AI has a strategy. Who owns it?
If AI is already being used across your organisation, the next question is accountability. Cybersecurity Link provides named, fractional AI executive leadership across strategy, governance, risk, security and board reporting.
Book a confidential strategy sessionOr write to us directly: hello@cybersecuritylink.com.auA senior executive replies, usually within one business day. We'll assess whether a vCAIO is the right model, and tell you if a different approach would be better.