Guided onboarding — from signup to first-value action in under three minutes

What changed

Two days before vCISO Lite officially incorporated, the first substantive customer flow shipped: a guided onboarding experience that gets a new customer from “signed up” to “first-value platform action” without watching a video or reading a doc.

Wizard

Three mandatory steps: company profile, business model, and compliance frameworks. Deliberately small, sized to collect what the platform needs to calibrate its risk math and personalize policy generation, not to run a discovery workshop.

Depth

Optional fields for company size, industry, regulatory posture, and existing controls sit behind a “go deeper” expander at each step. Three minutes to finish the minimum; longer if you want day-one personalization.

Checklist

A Stripe-style persistent progress indicator sits on the dashboard with first-value actions: generate your first policy, connect your first scanner, complete your first vendor risk assessment. Customers see where they are without navigating away from the work.

Context

What onboarding collects is the input to policy generation, framework selection, and risk calibration downstream. Every service the platform runs from the first minute is grounded in real business context, not defaults.

Why it matters

The compliance-platform onboarding experience most competitors ship is either a 90-minute implementation call scheduled two weeks after signup, or a 40-question form that customers abandon halfway through. vCISO Lite starts as a self-service product at $299/month — there is no implementation team on the other end of the signup, and there can’t be a 40-question form standing between the customer and their first policy. Guided onboarding is what makes that self-service model actually work.

Availability

Shipping today to every new customer at signup, on every platform tier.

Accounts created before the wizard existed can trigger it from the dashboard; the persistent checklist appears on first load after onboarding completes. Nothing is retroactively collected, so customers already past their first policy will see a mostly already-checked list.

Known limitations

This is iteration one. The three mandatory steps collect enough to calibrate the platform, not enough to replace a scoping conversation on multi-entity holding structures or acquisition-in-flight environments. Deeper org-structure questions arrive in a later cycle.

Progressive disclosure is opt-in. Customers who skip the “go deeper” expanders get calibrations from the minimum profile, which can read as generic for the first few generated artifacts until the deeper context is filled in.