Nick Charney Kaye
Operator · San Francisco
// INCIDENT READINESS · SAN FRANCISCO
Pass the renewal. Rehearse the incident. Keep the date.
The attackers have AI now: the wire-fraud email that reads exactly like your vendor, the voice on the phone that sounds like your managing partner, phishing at a scale no human crew could run. Your carrier knows it, and the questionnaire asks the same five things every year: multi-factor authentication everywhere, endpoint detection on every machine, backups with a dated restore test, an incident-response plan exercised in the last twelve months, and email that can’t be spoofed. Your broker won’t quote without them. I take a business of ten to a hundred people from “we think so” to a dated, written yes — and I rehearse the incident, AI-enabled fraud included, with you before you meet it.
Who this is for. Firms renewing or first buying cyber insurance. Registered investment advisers whose written incident-response program was due in June 2026 and whose exam is next. Companies answering a customer’s security questionnaire. Startups heading into SOC 2. Anyone with a sales window, a launch, or an event night that cannot move.
Who it is not for. Anyone who needs a penetration test or a formal audit — those require an independent party by law or by convention, and I bring one in rather than pretend. Anyone who wants 24/7 monitoring — that’s your MSP or a managed-detection service, and I’ll help you choose one.
What you’re afraid of, and what I do about it
- “The attackers have AI now.” They do, and the tabletop rehearses exactly that: the voice-cloned call asking to change a wire, the vendor invoice that is perfect in every detail but the account number. The fixes are mostly not AI — a callback rule for every payment change, multi-factor on every account, a plan everyone has read — and they are written down by the end of the day.
- “Our own people are pasting client data into chatbots.” Probably. The renewal Read inventories every AI tool in use and where its data goes; the AI-use policy Build puts the controls and a plain-language policy behind the inventory, so the question has an answer your insurer and your biggest client can read.
- “The questionnaire asks about AI and we don’t know what to say.” You’ll say what’s true, in writing: what’s in use, what’s governed, what’s blocked, and the date you last rehearsed an AI-enabled fraud.
- “One incident and we’re done.” That’s the fear worth taking seriously, and it’s the one a plan removes: who decides, who calls the broker and the lawyer, what you say to clients, and the backup you restored on a date you can name. I ran that plan for $630 million of live commerce without a notable loss.
The last time the date could not move
I was the program technical lead for incident response at TKO on the FIFA World Cup 2026 premium-hospitality e-commerce program: a 70-person operation across ticketing, identity, and payment partners that took over $630 million in under 15 months of live commerce without a notable loss. Readiness ran from a written checklist, incidents ran from a named owner, and monitoring showed what customers actually saw. The case record has the detail. Earlier, I built the tooling for a platform carrying over a trillion transactions a day at six-sigma uptime — that record too.
Four ways to buy it
Tabletop Exercise + After-Action Report
$2,000 · one day
- Two hours at the table with the people who would be in the room — leadership, operations, whoever answers the phone — walking one realistic scenario: a ransomware note, a voice-cloned wire-fraud call, a vendor breach
- A dated after-action report by the end of the day: what held, what didn’t, who decides what, and the five fixes in priority order
- The “exercised within the last twelve months” record underwriters ask for, written in the questionnaire’s own vocabulary
The Day. Credited in full toward a Read or a Build within 60 days.
Cyber-Insurance Renewal Readiness Read
$4,500 · one week
- The carrier’s control list — MFA, endpoint detection, backups and restore tests, patching and privileged access, the IR plan, email authentication — checked against what you actually run, not what the vendor dashboard claims
- An inventory of every AI tool your people use and where its data goes — the question the questionnaire now asks and most firms can’t answer
- A written gap list in the underwriter’s terms, with the evidence you can already produce and the evidence you can’t
- A go / no-go on the Build that closes the gaps before the renewal date, priced
The Read. A “go” scopes straight into the Build that closes the gaps.
Incident-Response Program
$6,500 · two weeks
- The incident-response plan: roles, severity levels, the first hour, and who calls the broker, the lawyer, and the customers
- Runbooks for the three incidents most likely to reach you, and the communication templates you’d rather not write at 2 a.m.
- The tabletop that exercises it, and the after-action report that proves it
A Build. Fixed price, fixed window, one at a time.
Tenant Hardening — Microsoft 365 or Google Workspace
$6,500 · two to three weeks
- Microsoft 365 or Google Workspace, hardened: multi-factor and conditional access, admin roles, email authentication (SPF, DKIM, DMARC), audit logging, retention, and backup
- Every change documented, with the before-and-after evidence packet your insurer, your auditor, or your biggest customer can read
- Up to 50 accounts, and the people who use them told what changed and why
A Build, for up to 50 accounts. Larger tenants are priced before work starts.
AI-Use Policy & Controls
$6,500 · two weeks
- An inventory of every AI tool in use — sanctioned or not — with where each one sends your data and what it keeps
- An acceptable-use policy in plain language your staff will actually follow, and the one-page briefing that teaches it
- The tenant controls that enforce it: sanctioned tools allowed, client data blocked from the rest, the record your insurer and your clients can read
A Build. The policy your staff will actually follow, the controls that enforce it, and the inventory your insurer and your clients ask for.
Go-Live Readiness for a Date That Cannot Move
$6,500–$25,000 · scoped to your window
- A sales window, a launch, an event night, or a season opener: the readiness review, the implementation checklist, the runbooks, and me on call through the window
- Partners and vendors held to the same checklist, so the integration that has never been tested under load is tested before the night
- Priced by the length of the window and what has to hold through it
A Build. Priced by the length of the window and what has to hold through it.
Written Security Program — Reg S-P or FTC Safeguards
$12,000–$15,000 · four weeks
- For registered investment advisers and small financial firms: the written incident-response program, the service-provider oversight, the customer-notification procedure, and the evidence an examiner expects to see
- Built with your compliance consultant or counsel where you have one, and built to hand to them where you don’t
A Build, for advisers and financial firms under 50 people.
SOC 2 Readiness, with a Partnered Auditor
$15,000–$25,000 · six to ten weeks
- The controls, the policies, the evidence plan, and the tooling decisions that get a startup from “we need SOC 2” to audit-ready
- An independent CPA firm, chosen and briefed, performs the audit — their fee is separate and quoted before you start
- The questionnaire your enterprise customer already sent you, answered in the meantime
A Build. The audit itself is performed by an independent CPA firm I bring in; their fee is separate and quoted up front.
Standing Security Lead
$6,000 / month floor · about two days a month · embedded $12,000 / month
- The standing security lead for a company that can’t justify a full-time one: renewals, questionnaires, vendor reviews, and the incident that finally comes
- About two days a month at the floor; embedded, about a day a week, at $12,000
- Month to month, billed in advance, two weeks’ notice to end it; at most two retainers at once
The Retainer. The continuity layer after a Build: the questionnaires, the renewals, the vendor calls, the honest “stop doing that.”
The five questions you’re actually asking
Do you hold a CISSP or another certification?
Will the tabletop satisfy my insurer?
How fast can you start?
Can I trust you with the keys?
What does it cost to start?
Hand it over
Hand over the date
The renewal, the exam, the go-live, or the incident you'd rather rehearse than meet. A few sentences is enough — read by me, answered within one business day.
Know it's a fit already? Book a 20-minute fit call › — the highest-intent path skips the form.
Answered within one business day, by me.
No form? Send it as an email instead.
Copy the template, fill in the blanks, and send it to hi@nickcharneykaye.com. One person reads every note and replies within one business day.
The fast way. Twenty minutes, this week, no deck required: book a 20-minute fit call.
The plain way. Email works too — hi@nickcharneykaye.com reaches me directly, answered within one business day. For anything sensitive, my public key is published.
Also taken directly: fractional CTO · AI workflow readiness · measurement, conversion & AI-search visibility · the four ways to engage.