Advisory & vCIO
The person who can walk into your board meeting, explain what the technology spend bought, what the risks are, and what happens next — without a single slide that needs translating.
Technology decisions made one invoice at a time
Between roughly fifty and fifteen hundred staff, most Australian organisations sit in an awkward gap. Too large to run on goodwill and whoever is best with computers. Not yet large enough to justify a full-time chief information officer, a security lead and a solutions architect on the payroll at the same time.
What fills the gap is a sequence of individually reasonable decisions — a renewal here, an urgent replacement there — that never add up to a direction. Three years later the architecture is an archaeology of expiring contracts.
A vCIO is a fractional version of the missing role. Not a salesperson with a roadmap template: someone accountable for whether the plan was right, reviewed against the same plan next quarter.
Six things you can actually hold
Advisory work that produces no artefacts is a conversation. These are documents that outlive the meeting.
- Three-year technology roadmap
- What changes, in what order, and why. Sequenced around contract expiry, hardware end-of-life, growth plans and the risks the assessment found — reviewed and revised each quarter rather than written once and filed.
- Defensible annual budget
- Operating and capital, split into committed, planned and discretionary, with the consequence of deferring each item stated. Built so you can defend a line to a board or a finance committee without calling us first.
- Risk register
- Technology and security risks with owners, ratings, treatments and review dates. The register is the thing an auditor asks for, and the thing that turns “we should probably fix that” into a decision somebody made.
- Quarterly business review
- Ninety minutes with your leadership: service performance against SLA, security posture, spend against budget, roadmap progress, and the decisions we need from you before the next one.
- Board & audit reporting
- A one-page technology and cyber summary in the language directors use, plus the supporting evidence pack for audit committees, insurers and client due-diligence questionnaires.
- Vendor & contract register
- Every technology contract, its renewal date, its notice period and its exit cost. Reviewed ahead of each expiry so renewals are decisions rather than defaults.
What a quarterly review actually covers
Same agenda every quarter, so you can see movement. It runs ninety minutes and you get the pack three working days beforehand.
- Service performance. Ticket volume by category, SLA attainment, and the three issues that generated the most support time.
- Security posture. Essential Eight movement, incidents and near-misses, phishing simulation results, and control drift.
- Spend. Actual against budget, licence changes, and anything trending in a direction you should know about now rather than at renewal.
- Roadmap. What we said we would do last quarter, what we did, and what moved — including things we got wrong.
- Risk register. New entries, changed ratings, and treatments completed or overdue.
- Decisions required. A short list of things only you can decide, with a recommendation and a cost against each.
Included quarterly on the Complete tier and monthly on Fortified. Available as a standalone engagement if your IT is managed elsewhere and you want an independent view.
Project-based advisory
Engagements with a defined question and a defined end, whether or not we manage your IT.
Technology due diligence
Pre-acquisition review of a target's technology, security posture, contracts and integration cost.
Provider review
An independent assessment of your current MSP against what you are paying for. We will tell you if they are doing fine.
Tender & RFP support
Writing the requirements, evaluating responses, and sitting on your side of the table rather than bidding.
Merger integration
Tenant consolidation, identity merging, licence rationalisation and a sequenced cutover plan.
What people ask
Is the vCIO just a sales role with a better title?
It is at some providers, and it is a fair thing to be suspicious of. The test is whether the roadmap ever recommends something that reduces what you pay them. Ours regularly does — licence consolidation, retiring a service, extending hardware life — and those recommendations are in the pack in writing.
Can we engage a vCIO without moving our managed services?
Yes, and it is a genuinely useful arrangement. You get an independent technical voice reviewing your existing provider's work. We are explicit upfront about the conflict of interest, and we will put in writing that we are not bidding for the managed services contract during the engagement.
How is it priced?
Included in the managed services agreement at the Complete tier and above. As a standalone engagement it is a fixed monthly retainer based on your size and meeting cadence, not an hourly rate — hourly billing discourages exactly the conversations you should be having.
Who attends from our side?
Whoever holds the budget and whoever feels the pain — usually a managing director or general manager, a finance lead, and an operations manager. If you have internal IT, they should be in the room, not reported on.
Get a technology plan you can defend
The assessment produces the first version of the roadmap and budget. From there it is a document that gets revised, not rewritten.