Illumen

What Illumen does

Illumen is a Seattle-based boutique cybersecurity GRC consulting firm founded in 2023 by three co-founders — Samuel Bradley (CEO), Ricky Waldron (COO), and Joshua Paulson (CTO) — whose combined experience exceeds 40 years across Fortune 500 security leadership, Big 4-style consulting, FedRAMP, and cryptocurrency security domains. The firm targets startups and small-to-medium businesses that lack dedicated internal security teams, offering tiered virtual CISO services (Startup $3,000/month, Accelerate $5,000/month, Propel $8,000+/month) that substitute for a full-time CISO at a fraction of the cost. Its service portfolio spans ISO 27001 internal audits (launch priced at $10,000), CMMC compliance with a Fast Track program, FedRAMP/CMMC/GovRAMP government services, project-based consulting, and the GRC Tech Accelerator (a 30-day implementation program).

The firm's technology surface centers on Compass, an AI-powered policy generation platform that produces 16+ customized security policies within 48 hours, currently in beta at $750 against a regular $1,000 price point. An add-on offering branded Forge extends into custom GRC engineering, including automated access reviews, AI-powered evidence validation, and real-time compliance dashboards. These capabilities are positioned as accelerators layered on top of human advisory delivery rather than autonomous software products.

Illumen's revenue model blends recurring vCISO subscriptions with one-time professional services (audits, assessments, remediation, policy generator purchases) and project-based consulting. Go-to-market is sales-led with a content-driven top-of-funnel (free scoping questionnaires for TISAX, CMMC, PCI DSS, FedRAMP, HITRUST; cost calculators; downloadable compliance templates; the Illumenati blog and newsletter), supported by direct consultation booking via website and phone. Customer evidence spans education (Texas Tech University HSC), AI startups (Patronus AI), and enterprise software (Syncfusion), with integration-adjacent work alongside GRC platform Secureframe. The company appears to be privately held and bootstrapped, with no disclosed institutional funding, parent entity, or public revenue figures.

Name

Illumen

Legal name

Illumen

Website

https://illumen.io

Company type

Private

Founded year

2023

Operating status

Operating

Headcount range

1–10 employees

Short description

Illumen is a Seattle-based boutique cybersecurity GRC consulting firm founded in 2023 that delivers tiered virtual CISO services ($3,000-$8,000+/month), AI-powered policy generation via its Compass platform, and compliance audits and assessments (ISO 27001, CMMC, FedRAMP, HIPAA) targeted at startups and SMBs lacking dedicated internal security teams.

Ownership category

akta.pro rank

Product category

Cybersecurity & GRC Consulting

NAICS

Other Scientific and Technical Consulting Services (54169), Computer Systems Design and Related Services (5415)

SIC

Services-Engineering, Accounting, Research, Management (8700), Services-Prepackaged Software (7372)

akta.pro industry

PRIMARYBPAHAEAG

Cybersecurity & Identity Consulting

Business & Public Services/Professional Services (Legal, Accounting, Consulting)/Technology & Digital Consulting

SECONDARYHDAEALAK

IT Governance, Risk & Compliance (IT GRC) Platforms

Hardware, Technology & Telecom/Enterprise Platforms & Databases/Enterprise Service Management (ITSM/ESM) Platforms

SECONDARYBPABAMAE

Security Consulting, Risk Assessment & Security Program Design

Business & Public Services/Facilities Management & Building Services/Security Management Services

Keywords

• Cybersecurity consulting
• Compliance services
• VCISO services
• GRC automation
• Policy generation

Headquarters

HQ city

Seattle

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations

Revenue model

1. vCISO Subscription Services: Tiered subscription-based vCISO services with monthly and annual billing. Three tiers: Startup ($3,000/mo), Accelerate ($5,000/mo), Propel ($8,000+/mo). Includes strategic security leadership, GRC platform ownership, policy development, and audit management.
2. ISO 27001 Internal Audit: Fixed-fee internal audit service covering all 123 controls with 4-week turnaround. Launch pricing at $10,000 for first 10 clients, regular pricing $15,000-$25,000.
3. Policy Generator (Compass): One-time purchase of comprehensive policy suite. Beta pricing $750, regular pricing $1,000. Includes 16+ customized policies delivered within 48 hours.
4. GRC Tech Accelerator: 30-day implementation program for GRC platform onboarding. Custom pricing based on scope. Includes gap analysis, platform configuration, policy creation, and audit readiness preparation.
5. Government Compliance Services: FedRAMP, CMMC, and GovRAMP consulting services including gap assessments starting at $4,000-$8,000+, remediation services (custom pricing), and Fast Track program (custom fixed pricing).
6. Project-Based Services: Ad-hoc consulting including security assessments, compliance consulting, penetration testing, and security architecture design tailored to specific project needs.

Pricing tiers

Go-to-market motion2 records

Distribution channels3 records

Marketing channels7 records

Core offering

Illumen is a boutique cybersecurity GRC (Governance, Risk, and Compliance) consulting firm that helps startups, SMBs, defense contractors, and cloud providers navigate regulatory frameworks including SOC 2, ISO 27001, CMMC, FedRAMP, HIPAA, PCI DSS, TISAX, and HITRUST. Its offerings center on tiered vCISO subscriptions ($3,000-$8,000+/month), the proprietary Compass AI-powered policy generator that delivers 16+ customized security policies within 48 hours, and specialized compliance services such as ISO 27001 internal audits, CMMC gap assessments, and project-based security consulting.

Product overview

Illumen is a boutique cybersecurity GRC consulting firm offering a portfolio of advisory services and technology-enabled solutions. The core offering revolves around Compass, an AI-powered policy generation platform that creates customized security policies within 48 hours. Complementing this are the GRC Technology Accelerator (30-day implementation program) and vCISO Services (tiered virtual CISO offerings from $3,000 to $8,000+ per month). The firm also provides specialized compliance services including ISO 27001 Internal Audits ($10,000 launch pricing), CMMC Compliance with a Fast Track program, Government Compliance (FedRAMP, CMMC, GovRAMP), and Project-Based Services. An add-on called Forge delivers custom GRC engineering and AI solutions including automated access reviews and AI evidence validation. Together, these services address the full compliance lifecycle from assessment through certification.

Differentiator

Problem solved

Functional benefit

Brands

• Compass: Policy Generator platform - an AI-powered intelligent platform that generates comprehensive security policies instantly, tailored to organizations' unique needs.

Products and services

• Compass Policy Generator
• vCISO Services
• GRC Technology Accelerator
• ISO 27001 Internal Audit
• CMMC Compliance Services
• Government Compliance (FedRAMP, CMMC, GovRAMP)
• Project-Based Security Services
• Forge — GRC Engineering & AI Solutions

Quantifiable outcome

• Save 40+ hours on GRC implementation with GRC Tech Accelerator program
• +4 more outcomes

Named customers3 records

Segments7 records

Ideal customer profiles7 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability3 records

Feature3 records

Partnerships

One partnership is on record.

• CompasscoreTechnology or IntegrationCompass is Illumen's proprietary AI-powered policy generation platform. It enables rapid creation of comprehensive security policies tailored to organizations' unique needs, delivering 16+ policies within 48 hours. The platform powers the Policy Generator service and GRC Tech Accelerator program.

Scale indicators4 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• Coalfire: Coalfire is a cybersecurity advisory and assessment firm with deep FedRAMP, CMMC, and PCI expertise serving both commercial and federal clients. Comparable to Illumen's government compliance services and multi-framework approach at larger scale.
• Drata: Drata is a major automated GRC platform competing for the same startup and mid-market compliance customers with continuous control monitoring for SOC 2, ISO 27001, HIPAA, and more. Overlap in customer segment and frameworks offered.
• Secureframe: Secureframe is both a partner (Illumen offers GRC Tech Accelerator for Secureframe customers) and a direct competitor in automated compliance for SOC 2, ISO 27001, HIPAA, and FedRAMP. Comparable SMB/startup focus and framework coverage.
• Sprinto: Sprinto is an automated compliance platform purpose-built for SaaS startups needing SOC 2, ISO 27001, HIPAA, and GDPR quickly. Targets the same SMB/startup segment as Illumen with a self-serve product model.
• A-LIGN: A-LIGN is a boutique cybersecurity compliance advisory and assessment firm offering SOC 2, ISO 27001, HITRUST, PCI, and FedRAMP services. Highly comparable boutique model with similar SMB-to-mid-market focus and framework breadth.
• Vanta: Vanta is a leading automated compliance platform targeting the same startup/SMB customer base as Illumen, offering SOC 2, ISO 27001, HIPAA, and other frameworks via software. Direct overlap in target market and compliance frameworks, though Vanta is product-led and Illumen is service-led.
• BARR Advisory: BARR Advisory is a boutique cybersecurity compliance firm specializing in SOC 2, ISO 27001, HIPAA, and FedRAMP for growth-stage and mid-market companies. Similar boutique positioning and SMB/startup customer overlap.
• Schellman: Schellman is a top-tier boutique cybersecurity and compliance assessment firm providing SOC 2, ISO 27001, PCI, HITRUST, and FedRAMP audits and advisory. Closely mirrors Illumen's boutique consulting positioning with deeper scale.

Emerging players

• Scrut Automation: Scrut Automation is an emerging GRC platform targeting growth-stage tech companies with automated evidence collection and policy management. Comparable SMB/startup focus with a product-led model that competes with both Illumen's consulting and Compass.

Broad incumbents

• KPMG (Cyber Practice): KPMG's cybersecurity practice offers GRC, vCISO-style services, and compliance assessments as part of a broad Big 4 portfolio. Overlaps with Illumen's offerings but serves larger enterprises and has global scale.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/illumenio
• LinkedInlinkedin.com/company/illumenio

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Illumen