Trustivum gives 10–100 person healthcare and AI companies everything an enterprise security review demands — the platform, the evidence, the monitoring, the ticketing, the pentest, and a 30-year practitioner as your fractional CISO. Buy the pieces you need, or the whole program for a tenth of a full-time hire.
Every entry below maps to something an auditor or an enterprise security questionnaire will actually ask you for. Start with one; add the rest when the next deal demands it.
HIPAA & SOC 2 readiness without the enterprise-GRC price tag. Weekly evidence prompts keep you audit-ready year-round instead of panicking every twelve months.
A named security executive — not a portal. William Janness owns your risk register, runs your audit, sits in on the enterprise prospect's security review, and answers the 2 a.m. incident call.
The appliance that watches your environment between audits. Control drift — a disabled MFA policy, an exposed bucket, an unpatched host — gets flagged the day it happens, not the day the auditor finds it.
A standalone helpdesk that doubles as a compliance engine. Every access request, change approval, incident, and offboarding ticket becomes SOC 2 / HIPAA evidence automatically — the paper trail writes itself.
The annual test your customers' security teams ask for by name — scoped honestly for companies your size, with findings triaged into a remediation plan instead of a 90-page PDF nobody reads.
A full-time CISO costs $250,000–$350,000 fully loaded — and most companies under 100 people don't have full-time CISO problems. They have an audit deadline and a deal on hold. Price accordingly.
Our center of the target: healthcare-adjacent software and AI companies, 10–100 people. Telehealth platforms, health-data analytics, clinical AI tools, digital health SaaS — any company where PHI makes HIPAA a legal obligation on day one, and where the first hospital, payer, or enterprise deal makes SOC 2 Type II a commercial obligation shortly after.
These companies face both frameworks at once with no security hire on the org chart — and the regulatory floor is rising: the updated HIPAA Security Rule moving through HHS makes formerly "addressable" safeguards mandatory and explicitly pulls AI tools into required risk analysis. If your product is AI touching patient data, your compliance program now has to understand machine learning infrastructure. Ours does — our founder runs GPU fleets at an enterprise AI company for a living.
Second fit: B2B AI and SaaS startups whose enterprise pipeline just hit the security-review wall. Third: Chicagoland professional services firms (RIAs, healthcare practices, agencies) that outgrew their IT guy but will never hire a CISO — we serve them directly or through their existing MSP.
William Janness has run production infrastructure since 1992 — three decades as the outsourced technology leader for up to 50 small and mid-sized companies, and today the Head of Information Security & Compliance at an enterprise AI company, where systems he designed have run 1,450+ consecutive days without unplanned downtime.
He writes the policies and the code that enforces them. When your auditor asks how a control works, your vCISO shows them the implementation — not a slide about it.
wjanness.com → full record of work
A 30-minute fit call. You describe the audit deadline, the questionnaire, or the customer requirement — we tell you exactly which pieces you need and which you don't. No charge, no deck.
Book the fit call