Strategic advisory for AI & security founders

Better me
than the market.

I help early-stage founders fix their narrative, before VCs and CISOs do it for them, less kindly. VCs buy visions; CISOs and customers buy reality. The gap between the two is where Seed rounds and first enterprise pilots quietly die.

Run by someone who's actually built and run security programs, not someone who read a deck about them. I tell founders the truth while it's cheap to hear it.

Book a call → See how I work
Who's actually doing this

Just me. And twenty-five years of having seen this movie before.

Mike Geehan, founder of Triarch Security
Save your photo as
assets/img/mike-geehan.jpeg

I'm Mike Geehan, and Triarch Security is me. Not a fund, not a logo wall, not a “we.” Most recently I ran Security & Technology at Cockroach Labs, where I built the program from nothing: SOC 2 Type 2, ISO 27001 and 42001, PCI-DSS across AWS, Azure, and GCP, plus an AI governance program built before anyone had agreed what “AI governance” even meant.

Before that, security leadership at Akamai and ID.me, and twelve years running professional services at HP. And two decades back I co-founded a software company, so I've sat in the founder's chair too, sweating the pitch and the payroll.

That's the whole point of the three pillars below. Most advisors have lived in one of them. I've lived in all three. And I'll tell you which of yours is about to give, minus the flattery.

Former Head of Security, Cockroach Labs ex-Akamai · ex-ID.me ISO 42001 · SOC 2 · PCI-DSS 12 yrs professional services M.Eng, King's College London
The model

Three practices. One operator behind all of them.

Most advisors live in one of these. I've lived in all three: founder, security leader, and the person who stood up AI governance before the standard existed. Each practice runs on its own triad, and the danger is always the seam between them. That's the whole point of the name.

Pillar 01 · Start-up Advisory

Make the pitch survive the people who check it.

Product-market fit pressure-tested across three things a skeptical VC or CISO will weigh at once: the story you tell, the proof behind it, and the spine carrying it.

01 · STORY

The pitch a skeptic believes.

The pitch, the narrative, the product-market-fit claim. What you tell investors and buyers about why you matter.

02 · PROOF

What's true when checked.

Your security posture, your compliance reality, the technical substance. What's actually true when a skeptic checks.

03 · SPINE

A team they can bet on.

The founders, the early hires, the operators who carry the program. What VCs and CISOs are really betting on, long before the tech matters.

Pillar 02 · AI Governance

Your company is already running on AI. The question is whether anyone's governing it.

Every team you have is already piloting AI, sanctioned or not. I lead organizations through adoption that's actually safe: governance built to speed the rollout, not stall it. Policy, process, and tooling, with the guardrails on from day one.

01 · POLICY

Policy that holds up.

Acceptable-use, model and data governance, and standards aligned to ISO 42001 and the NIST AI RMF. Written to survive an audit and a board question, not to die in a wiki nobody reads.

02 · PROCESS

Process people will actually follow.

Intake and risk review for new AI use cases, vendor and model assessment, human-in-the-loop checkpoints, and clear incident paths, embedded into how teams already work so adoption accelerates instead of routing around you.

03 · TOOLING

Tools deployed safely.

Selection, configuration, and rollout of AI tools and agents with the guardrails on from day one: access, data boundaries, logging, and monitoring. Shadow AI brought into the light, not just banned.

Pillar 03 · Fractional Security Leadership

Senior security leadership, without a $400k hire on the books.

The embedded version of the work: stand up the program, run operations day to day, and carry the authority in the diligence calls and board conversations a founder shouldn't be answering alone.

01 · PROGRAM

The function, built from nothing.

Framework, standards, and roadmap: SOC 2, ISO 27001, PCI-DSS. The first hires and the evidence engine. Your org stops looking like a compliance checkbox and starts looking like a company.

02 · OPERATIONS

Security, run day to day.

The program kept alive between audits: risk decisions, vendor reviews, incident response, and the steady cadence that keeps posture real instead of a point-in-time screenshot.

03 · AUTHORITY

The adult in the room.

Board-ready reporting, contract redlining, and executive presence in procurement, diligence, and the late-stage customer questions a founder shouldn't be the one answering.

I don't sell fear. I sell momentum. Most security firms slow the deal. I help close it. The gap between your pillars is where early companies quietly die, and it's invisible from the inside. Finding it is the job.
The shape of the work

What I don't do.

Plenty of good people sell access. I sell readiness, the part that has to be true first.

  • ✕I won't open my network for you.
  • ✕I won't find your design partners or secure your POCs.
  • ✕I won't do free consulting dressed up as a “strategic partnership.”
  • ✕I won't sugarcoat. If your roadmap is a liability, I'll tell you, and then I'll help you fix it.
The advisor market sells access. I sell readiness. Plenty of good people do intros, design partners, and warm leads. I do the part that has to be true first: the part that decides whether the intro, the design partner, and the sale actually land. When someone does open a door, I make sure you walk through it and don't get found out.
The offering

Ways to work with me.

Start with a 90-minute Teardown, scope a fixed-price sprint, buy time by the hour, or bring me in on retainer. Each one maps to one of the three pillars above. I don't sell anyone more than the problem needs.

Teardown & Sprints. Fixed scope.

A set price, a set timeline, a hardened artifact at the end. Start small with a Teardown, or scope a full sprint when one arch is bleeding.

Office Hours. Pay as you go.

Review by the hour, or a light monthly slot. Judgment on tap, without signing up for a project.

Embedded. Retainer.

Ongoing technical authority across all three pillars. For when you've outgrown one-off fixes.

Start-up Advisory · Entry point

The Pitch Teardown

Ninety minutes, live and recorded: I tear into your deck and pitch as the skeptical investor and the skeptical technical buyer at once. You get a written trust-gap punch list within 48 hours, every hole ranked by what kills the round fastest. Built to be a yes when a full sprint isn't.

$95090 min + 48-hr writeup
Start-up Advisory · Story · Sprint

Adversarial Pitch & Narrative Review

The full rebuild. I pressure-test the pitch, deck, and PMF claim, then hand back four artifacts: a trust-gap audit, the exact questions a skeptical buyer will ask with your answers, a narrative hardened to survive diligence, and a fix list ranked by deal impact.

Scoped per engagement2–4 weeks

Your $950 Teardown fee is credited if you upgrade within 30 days.

Start-up Advisory · Proof · Sprint

Security Positioning Sprint

Make your security real, then make it legible to whoever's checking. Compliance alignment, AI governance, and a posture that survives a Fortune 500 review, all in one engagement.

Scoped per engagement4–8 weeks
AI Governance · Sprint

AI Governance Sprint

Stand up AI governance that speeds the rollout instead of stalling it: acceptable-use and model/data policy aligned to ISO 42001 and the NIST AI RMF, an intake-and-risk-review process teams will actually follow, and your AI tools and agents deployed with the guardrails on from day one. Shadow AI brought into the light, not just banned.

Scoped per engagement3–6 weeks
Fractional Security Leadership · Sprint

Security Program & Team Build

Stand up the early security function: framework, standards, the first hires, the evidence engine. Your org stops looking like a compliance checkbox and starts looking like a company.

Scoped per engagement4–6 weeks
Start-up Advisory · Spine · Sprint

Advisory Board Build

An advisory board built to throw off real signal instead of sitting on a slide as a vanity metric. Recruitment, structure, a compensation framework, and neutral facilitation so the feedback actually lands.

Scoped per engagement6–8 weeks
Any pillar · Flexible

Office Hours

Judgment on tap, without a project. Buy time by the hour for an ad-hoc review (a new deck, a board doc, a security questionnaire that just landed in your inbox), or hold a standing monthly slot for ongoing access.

$350/hr3-hr blocks · or a standing monthly slot
Fractional Security Leadership · Retainer

Fractional Security Leadership (vCISO)

The embedded version. Senior security leadership, board-ready reporting, contract redlining, and executive presence for enterprise negotiations. All of it without a $400k full-time hire on the books.

Advisor · 20%
Direction & oversight
Board cadence, escalations, the second pair of eyes
Embedded · 35%
Hands on the program
In standups, in diligence, in customer calls
Operator · 50%
Front-line leadership
Running security day to day, owning the outcome

Retainer terms scoped per engagement, including a continuous-PMF / lightweight-advisory variant.

Pre-seed, pre-revenue, money's tight? Say so. The Teardown is built to be real work you can afford before you've raised a dollar. Beyond that, terms flex: cash, equity, a blend, or deferred. Part now, part when the next round closes. The job is to make the work possible, not to pretend your budget isn't tight.

I don't exist to echo your pitch.
I exist to harden it.

Better me than the market. Find the gap in private, while it's still cheap to fix.

Let's talk →
In their words

Don't take my word for it.

I make a living telling founders the hard version. Here's what they say once the work is done.

“
From our first conversation, Mike provided detailed, actionable feedback on what our product needed to address. He understood our position as a service provider and offered practical advice as we grew. Deeply active in the security community and very well connected, he introduced us to folks who shared valuable perspectives from many angles. Mike played a real role in elevating our position in the market.
Co-Founder
TraceForce
“
Working with Mike reshaped how we talk about CognitivTrust. We came in still working through our value proposition and the right way to frame the messaging; Mike helped us find the version of the story that actually lands with CISOs and gives us a clear way to communicate the value we deliver. What makes him a rare find as an advisor is the way he engages: responsive, patient, and willing to read between the lines of what you're trying to say. He adjusts to your pace, your priorities, and your expectations and the work gets sharper for it.
Founder
CognitivTrust
“
We brought Mike in to pressure-test our product-market fit, and he did. His feedback and guidance as CISO was priceless. But the real unlock was a partnership he proposed which would deepen our ecosystem integration and open revenue paths. He then helped us actually build it by facilitating introductions. It's becoming a dependable way for us to grow.
Co-Founder & CRO
Evé Security
Get in touch

Find out where your startup breaks from me. In private, while it's cheap.

Better than from a VC or a customer later. Book a call, or send a note and I'll reply within 48 hours.

Goes straight to my inbox. Honest answers get better calls.