SYBER Security - Ciso-as-a-service, DPO-as-a-service & GRC

What SYBER Security - Ciso-as-a-service, DPO-as-a-service & GRC does

SYBER Security is a Tel Aviv-headquartered, privately-held professional services firm offering outsourced information security and data protection leadership to Israeli and international organizations. Its core offerings are CISO as a Service (vCISO) and DPO as a Service, delivered by Israeli attorneys holding CDPSE (ISACA) certification alongside ISO 27001 Lead Implementer credentials. The firm does not operate a proprietary software platform; instead it provides human expert consulting and integrates client-side compliance automation tools (Vanta, Drata, Sprinto, Anecdotes, OneTrust, Scrut).

The company's service portfolio spans recurring fractional CISO and DPO retainers (priced at 7,000-25,000 ILS/month for CISO and 4,000-12,000 ILS/month for DPO, with bundled CISO+DPO packages), plus project-based certification consulting across ISO 27001, ISO 27701, ISO 42001, SOC 2 Type I/II, and HIPAA, as well as Cyber Due Diligence for VC/PE transactions and a free automated Amendment 13/GDPR website compliance scan. Target segments include Israeli SaaS/B2B startups, FinTech, MedTech/healthcare, energy and critical infrastructure, insurance, and early-stage startups from Seed through growth stages, with cross-border support for clients serving US and European customers.

Commercially, SYBER runs a sales-led, founder-driven GTM motion with no disclosed institutional funding, no disclosed headcount, and no channel partners. Distribution is direct via website contact forms, phone (058-759-0000), and LinkedIn, supported by a Hebrew-language blog and content marketing. The firm is owned and led by founder Attorney Ariel Lilaev, who serves as CISO, DPO, and ISO 27001 Lead Implementer, creating significant key-person concentration in the operating model.

Name

SYBER Security - Ciso-as-a-service, DPO-as-a-service & GRC

Legal name

SYBER - Cyber Security Consulting

Website

https://syber.co.il

Company type

Private

Operating status

Operating

Headcount range

11–50 employees

Short description

SYBER Security is a Tel Aviv-based boutique cybersecurity and privacy consulting firm offering fractional CISO and DPO services, plus ISO 27001/SOC 2/ISO 42001 certification consulting and Cyber Due Diligence to Israeli SaaS, FinTech, MedTech, and startup clients.

Ownership category

akta.pro rank

Product category

Cybersecurity Consulting Services

NAICS

Investigation and Security Services (5616), Security Systems Services (56162)

SIC

Services-Detective, Guard & Armored Car Services (7381)

akta.pro industry

PRIMARYBPAKAHAI

Identity & Access Security Services (IAM, PAM, Zero Trust)

Business & Public Services/Security & Investigations Services/Cybersecurity & Digital Forensics Services

SECONDARYBPAEADAB

Security Operations Center (SOC) as a Service

Business & Public Services/IT & Digital Services (Managed Services, Systems Integration)/Cybersecurity Services (MSSP)

SECONDARYHDADAFAH

Privacy Management (Consent, DSAR, RoPA)

Hardware, Technology & Telecom/Cybersecurity/Data Security & Privacy (DLP, Encryption, Key Mgmt)

Keywords

• Fractional CISO services
• Data protection officer consulting
• ISO 27001 certification consulting
• SOC 2 compliance advisory
• GRC managed services

Headquarters

HQ city

Tel Aviv

HQ country

Israel

HQ region

Middle East

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Marketing or Sales, Technology or R&D

Revenue model

1. CISO as a Service: Recurring monthly retainer for fractional Chief Information Security Officer services. Provided at 1 day/week, 2 days/week, or full-time equivalent levels. Includes ongoing strategy, risk management, policy writing, infrastructure security, customer RFP responses, cloud committee management, and board representation. Pricing varies by scope and organization size.
2. DPO as a Service: Recurring monthly retainer for external Data Protection Officer services, delivered by a licensed attorney with CDPSE certification. Covers GDPR, Israeli Amendment 13, CCPA, HIPAA compliance. Includes ROPA management, DPIA, DSAR handling, privacy policy drafting, and regulatory representation.
3. Certification Consulting (ISO 27001, SOC 2, ISO 42001): Project-based consulting engagements to prepare organizations for ISO 27001, SOC 2 Type I/II, ISO 42001 (AI governance), and ISO 27701 certifications. Includes Gap Analysis, policy writing, control implementation, internal audit, and auditor accompaniment through the certification process.
4. GRC and Training Services: Governance, Risk & Compliance managed services, including GRC platform management (Vanta, Drata, Anecdotes, Sprinto, OneTrust), employee cybersecurity awareness training, GDPR training, HIPAA training, and Management Review facilitation per ISO 27001 requirements.
5. Cyber Due Diligence: One-time or project-based cyber due diligence engagements for VC, PE, and corporate acquirers before investment or M&A transactions. Includes basic DD (3-5 working days) for early-stage companies and deep DD (2-4 weeks) for M&A/PE. Deliverables include risk reports, maturity scoring, remediation plans.
6. Data Registers / Amendment 13 Compliance: Project-based services for mapping data registers, registration with the Israeli Privacy Authority, security level determination (basic/intermediate/high), policy drafting, and ongoing Amendment 13 compliance.
7. Hourly/Ad-hoc Consulting: Hourly consulting engagements at 350-600 ILS/hour for specific tasks: RFP responses, Gap Analysis, policy writing, legal document review (DPA, MSA, SCC). Suitable for one-time or ad-hoc needs.

Pricing tiers

Go-to-market motion1 record

Distribution channels1 record

Marketing channels5 records

Core offering

SYBER Security is a professional services firm providing fractional Chief Information Security Officer (CISO as a Service) and external Data Protection Officer (DPO as a Service) consulting, delivered by licensed attorneys with technical cybersecurity certifications such as CDPSE and ISO 27001 Lead Implementer. The firm also offers end-to-end certification consulting (ISO 27001, SOC 2 Type I/II, ISO 42001, ISO 27701), GRC platform implementation and management, cyber due diligence for VC/PE transactions, and advisory across Israeli, EU, and US privacy and security regulations.

Product overview

SYBER Security is a professional services firm offering cybersecurity, privacy, and compliance consulting. The core offerings consist of CISO as a Service (vCISO) providing external information security leadership, and DPO as a Service delivered by certified lawyers with CDPSE credentials. These are complemented by specialized consulting services including ISO 27001/SOC 2 certification consulting, GRC and training programs, cyber regulations advisory (covering Amendment 13, GDPR, EU AI Act, NIS2, HIPAA), ISO 42001 AI governance, internal audit services, Cyber Due Diligence for M&A/investment, and network/infrastructure security consulting. SYBER serves organizations in Israel and internationally, with particular expertise in SaaS, FinTech, MedTech, and startup sectors requiring regulatory compliance.

Differentiator

Problem solved

Functional benefit

Products and services

• CISO as a Service (vCISO) External Chief Information Security Officer service providing ongoing security strategy, risk management, policy writing, infrastructure security, customer RFP/security questionnaire responses, cloud committee management, board representation, and Incident Response. Delivered on a fractional basis to Israeli and international organizations that cannot justify a full-time internal CISO.
• DPO as a Service External Data Protection Officer service provided by a certified attorney with CDPSE credential. Covers GDPR, Israeli Privacy Protection Law Amendment 13, CCPA, HIPAA, ROPA management, DPIA execution, DSAR handling, DPA/MSA/SCC drafting, and regulatory representation before data protection authorities.
• ISO 27001 / SOC 2 Certification Consulting Project-based consulting engagements to prepare organizations for ISO 27001, SOC 2 Type I and Type II, ISO 27017, ISO 27018, and ISO 27701 certifications. Includes Gap Analysis, policy drafting, control implementation, internal audit, and accompaniment through Stage 1 and Stage 2 audits with certification bodies.
• ISO 42001 AI Governance Consulting Artificial intelligence governance consulting including ISO 42001 implementation, AI inventory creation, AI policy writing, EU AI Act compliance (risk classification, technical documentation, conformity assessment), and AI risk assessment services for organizations deploying AI systems.
• GRC and Training Services Governance, Risk & Compliance managed services including GRC framework building, GRC platform implementation and operation (Vanta, Drata, Sprinto, Anecdotes, OneTrust, Scrut), employee cybersecurity awareness training, GDPR training, HIPAA training, and Management Review facilitation per ISO 27001.
• Cyber Due Diligence Cybersecurity due diligence engagements for VC, PE, and corporate acquirers before investment or M&A transactions. Includes basic DD (3-5 working days) for early-stage companies and deep DD (2-4 weeks) for M&A/PE, with deliverables of risk reports, maturity scoring, and remediation plans.
• Cyber Regulations Advisory Advisory services for Israeli and international cybersecurity and privacy regulations including Israeli Privacy Protection Law Amendment 13, GDPR, EU AI Act, NIS2, HIPAA, PCI DSS, DORA, NIST CSF, and Israeli National Cyber Directorate (INCD) requirements. Includes compliance gap remediation and regulatory representation.
• Data Registers Management Consulting for data register mapping, registration with the Israeli Privacy Protection Authority, security level determination (basic/intermediate/high), policy drafting, and ongoing compliance maintenance under Amendment 13 and GDPR.
• Network and Infrastructure Security Consulting Network and infrastructure security services including API security, server hardening, Zero Trust architecture design, cloud security across AWS/Azure/GCP, endpoint security, and database security consulting, aligned with NIST SP 800-53 and CMMC 2.0 controls.
• Internal Audit Services Professional internal audit services conducted per ISO 27001 requirements before external certification audits, identifying findings and preventing certification failures through structured control testing and reporting.

Quantifiable outcome

• CISO as a Service costs 75-90% less than an internal CISO hire (8,000-25,000 ILS/month vs. 40,000-80,000 ILS/month total internal cost including recruitment, equipment, and turnover risk)
• +3 more outcomes

Named customers6 records

Segments6 records

Ideal customer profiles6 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature1 record

Partnerships

Three partnerships are on record, tiered core.

• CPA Audit Firms (BDO, Deloitte, Grant Thornton, Schellman)coreImplementation/ SI/ Consulting PartnerSYBER works with US-based CPA firms authorized as AICPA auditors to perform SOC 2 Type I and Type II audits. The company accompanies clients through the audit process, coordinates with auditors, and manages the relationship. SYBER does not perform audits itself — it prepares clients to pass them.
• BSI / PECBcoreTechnology or IntegrationSYBER's founder Ariel Lilaev holds ISO 27001 Lead Implementer certification from BSI/PECB. The company uses these certification bodies as the certifying partners for ISO 27001 and related standards. SYBER accompanies clients through the certification process up to and including Stage 1 and Stage 2 audits with these bodies.
• Vanta, Drata, Sprinto, Anecdotes, OneTrust, ScrutcoreTechnology or IntegrationSYBER implements, manages, and operates GRC compliance automation platforms for clients including Vanta, Drata, Sprinto, Anecdotes, OneTrust, and Scrut Automation. SYBER provides full-service managed GRC including initial setup, integration with development tools, evidence management, and pre-audit updates. These are tooling partners where SYBER acts as the implementing and managing partner.

Scale indicators2 records

Recent moves6 records

Expansion highlights5 records

Broad incumbents

• Deloitte: Deloitte's cyber risk services practice offers vCISO, GRC, ISO 27001/SOC 2, NIS2, and privacy advisory at global scale. It competes with SYBER for larger Israeli enterprise and multinational clients and brings breadth SYBER cannot match.
• Accenture Security: Accenture's security practice delivers managed security, GRC, identity, and OT/ICS services at global scale. It overlaps with SYBER's MSSP-adjacent GRC platform management and large-organization CISO engagements.
• EY (Ernst & Young): EY's cybersecurity consulting practice covers GRC, ISO 27001, SOC 2, privacy, and OT/ICS security. As a Big 4 incumbent, it competes for the same Israeli and international clients seeking compliance leadership.
• KPMG: KPMG delivers cyber and privacy advisory including vCISO, ISO 27001, NIS2, and DORA services globally. It is a broad incumbent and a comparable reference point for premium-fractional CISO pricing and delivery.
• PwC: PwC provides cybersecurity and privacy advisory (including vCISO-style engagements, GDPR, NIS2, DORA, and SOC 2 readiness) to enterprise and mid-market clients. It is a broad incumbent that overlaps significantly with SYBER's regulated-vertical engagements.

Others

• Drata: Drata is a GRC automation platform competing in the same SOC 2/ISO 27001 market where SYBER provides implementation consulting. Like Vanta, it is both a tooling partner and an adjacent competitor reducing the scope of human services.
• Vanta: Vanta is a leading GRC/compliance automation platform for SOC 2, ISO 27001, HIPAA, and more. SYBER lists Vanta as a tooling partner, but Vanta increasingly bundles automated evidence collection and policy features that compete with the manual consulting hours SYBER sells.
• Sprinto: Sprinto is a compliance automation platform popular with SaaS startups for SOC 2 and ISO 27001. SYBER lists Sprinto as an implementation partner; Sprinto's automation roadmap is an adjacent competitive force against manual GRC consulting.

Emerging players

• Thoropass: Thoropass is a compliance automation platform combining software with in-house audit and vCISO-style expertise for SOC 2, ISO 27001, and HIPAA. It is an emerging player attacking SYBER's market from a hybrid product-plus-services model.
• Cynomi: Cynomi is a vCISO automation platform that helps MSSPs and consultancies deliver fractional CISO services via software. It is a partial peer because it competes for the same end-customer budget (vCISO/GRC) but attacks from a software-automation angle rather than human advisory.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat4 records

Key risks5 records

Key highlights6 records

Customer concentration

• Facebookfacebook.com/101144074936895
• LinkedInlinkedin.com/company/ciso-as-a-service-consulting

Compliance16 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about SYBER Security - Ciso-as-a-service, DPO-as-a-service & GRC