vCISO
Fractional Security Leadership
Senior security leadership without the full-time hire. I set direction, make the hard calls, and give your team someone to escalate to — a few days a month.
Now taking a small number of founder engagements
Security advice for founders, in cleartext.
A 1:1 advisory practice for security-conscious founders. Senior judgment on the risks that actually threaten your company — no frameworks theater, no fear-selling, no junior consultants. Just clear thinking, delivered directly.
Independent · senior-only · no products sold, no kickbacks
Engagements
Ways I work with founders
Every engagement is scoped to your stage and your actual risk — not a template. Start with one, or combine them into an ongoing relationship.
Due diligence
Diligence & Fundraise Readiness
Sail through investor, acquirer, and enterprise security reviews. We fix what's real, document what matters, and get you to a clean answer fast.
Retainer
Founder 1:1 Advisory
A direct line for the decisions that don't fit a ticket — a risky launch, a first security hire, a scary email from a researcher. Senior judgment, on demand.
Review
Architecture & Threat Modeling
Find the design flaws before attackers do. We map trust boundaries, rank threats by blast radius, and leave you with fixes ranked by what actually matters.
Compliance
Security Program Foundations
SOC 2 and ISO 27001 without the theater. A right-sized program that earns trust and passes audits — built to fit how your team already ships.
Response
Incident & Crisis Support
When something goes wrong, you want a calm expert in the room. I help you triage, communicate, and come out the other side with a stronger posture.
Approach
Clear thinking beats more tooling
The bottleneck for most startups isn't which scanner they bought — it's knowing which risks deserve their limited attention. That's the whole job.
- 01
Intro call
A free 30-minute conversation. We figure out what you're worried about and whether I'm the right person to help.
- 02
Assess
A focused review of your architecture, posture, and pressures. You get a clear, prioritized picture of where you actually stand.
- 03
Advise & execute
We work the priorities together — as a one-time engagement or an ongoing 1:1 relationship as you scale.
Risk, ranked honestly
Most security advice is a checklist that treats every risk as equal. I tell you the two or three things that could actually end your company — and what to safely ignore for now.
Plain language, always
No acronym fog, no fear-selling. You'll understand every recommendation well enough to defend it to your board, your customers, and your engineers.
Built for how you ship
Security that fights your velocity gets routed around. I design controls that fit your stack and your pace so the secure path is also the easy one.
Independent by design
I don't resell tools, take vendor kickbacks, or pad hours. My only incentive is that your risk goes down and your trust goes up.
CM
About
Hi, I'm Corey Mahan.
I founded Cleartext Advisory because the founders who most need good security judgment can rarely find it. The senior people are locked inside big companies, and everyone else is trying to sell you a tool.
I work with a small number of founders at a time, one on one, so the advice is genuinely mine and genuinely yours — not a deck a junior consultant assembled the night before.
- Years operating inside security teams — building programs and responding when things break
- A builder's respect for shipping velocity, not just a checklist
- Straight talk your board and your engineers will both trust
- No vendor allegiances — advice you can actually rely on
FAQ
Questions founders ask
Still unsure if it's a fit? Justreach out — a short call usually settles it.
Who do you work with?
Founders and early leadership at startups that take security seriously — typically pre-seed through Series B. Often there's no security hire yet, or the first one just started and needs someone senior to lean on.
How much does it cost?
Engagements are scoped to your stage and needs, from a fixed-scope review to a monthly retainer. The intro call is free, and I'll always tell you honestly if you don't need me yet.
Do you replace hiring a security team?
No — I make your hiring better. I help you figure out when to hire, what to look for, and how to set that person up to succeed. For many startups I'm the bridge until a full-time hire makes sense.
Can you help us pass SOC 2 or a customer security review?
Yes. This is one of the most common reasons founders call. We fix what's genuinely risky, document what auditors and enterprise buyers need, and get you to a confident, defensible answer — without turning your company into a compliance shop.
We think something happened. Can you help right now?
Yes. I offer incident and crisis support — triage, containment guidance, communications, and the calm second opinion you want in the room. Reach out and mark it urgent.
Do you do one-off engagements?
Absolutely. Plenty of founders start with a single architecture review or diligence sprint. Some stay on as an ongoing 1:1 relationship; others just come back when they need me.
Let's talk
Get a clear read on your security.
Book a free 30-minute intro call. We'll talk through what's keeping you up at night and whether I can help. No pitch, no obligation.
Typically replies within one business day.