3Q26 Wrap Up

We said three. We shipped fourteen.

Name: vCISO Lite
Brand: vCISO Lite
Availability: InStock

Every launch we named landed, plus eleven more. Your auditor now works inside vCISO Lite, two years ahead of plan. And the framework your next deal asks for? Almost certainly covered: 250 now, up from 14.

See what shipped What’s next in Q4

Cartoon: a boardroom of directors leans in, puzzled, over a single sheet of paper while a calm executive sits back. A risk heat map hangs crooked on the wall. — “It says we did what we said we’d do. Is that… allowed?”

Jul – Sep 2026

Here’s what we shipped this quarter

Select a mark on the timeline, or filter by category.

Product — launches
Depth — platform refactors
Field & research
Security & trust
Velocity — how we run
Rows group launches, depth, field/trust, and velocity. Same-day ships stack vertically — higher mark first.

The through-line

Why these? Why now?

The roadmap decided what we’d build. The calendar decided the order. Q4 is when next year’s budgets get argued, year-end deals close, and auditors start fieldwork. Everything we shipped in Q3 lands before those deadlines, not after.

The calendar demanded it.

Every industry has its calendar. Every role inside it has its own. Q4 budget planning, retail’s holiday freeze, higher-ed’s academic year, PE close windows, insurance renewals, audit fieldwork — the seasons customers plan around, not ones we invent. We ship to meet them.

What customers get

Every program ranked by the expected loss it removes per dollar.
A board slide, CEO one-pager, and CFO letter, all from the same plan.
With Preflight, investors get a cyber read on a target in 20 minutes, before year-end closes.

Autonomy needs a witness.

Everyone wants agents that can do the work, but accountability is just as important. That’s why we shipped Trustworthy Autonomy™ and the Evidence Graph together. Every agent decision has to hold up to people who don’t trust the system that made it. Trust our logs becomes verify our math.

What customers get

Hand compliance work to agents without losing the audit trail.
Every action signed, explained, and re-checkable by a third party.
Lean teams get back the days they spent rebuilding evidence by hand.

The pain wouldn’t wait.

The audit firm console was slated for 2028. Firms were heading into year-end engagements without a book-of-work view, so we pulled the timeline in. SCF and the policy engine deepened what customers already use, on the same reasoning.

What customers get

Auditors review evidence inside vCISO Lite, read-only by design.
Roughly 250 frameworks from one control set, up from 14.
Every policy is a promise you can back — or one you’ve honestly flagged as a gap.

Thought Leadership This Quarter

Written this quarter.

Weekly blog posts on the content calendar. Field Notes when news and incidents demand a careful read. Same voice, different cadence.

Field Notes

An Eight-Hour Incident. Five Months to Count.

Sep 15, 2026

CareCloud’s eight-hour disruption took five months to scope. The gap is structural, and what signed per-event evidence would collapse into an afternoon.

All Field Notes →

From the blog

See all on the blog →

Look ahead

Here’s what we’re delivering in Q4

Three tracks pick up where Q3 left off. Two go GA. The third turns a diligence number that already exists into contract language a buyer’s counsel can drop straight in.

General availability

Trustworthy Autonomy™ opens to everyone

Design partners ran the Q3 build against real audits for two months, and what they found shapes the commercial version. The rule that every agent action has to earn its place stays exactly as it was in beta.

What opens up

Pricing based on the work agents take over, not seats you might not fill.
Contract terms your legal team can read in one paragraph, not nine.

Partner program

Operator white-label goes GA

vCISOs and consulting firms running vCISO Lite for their clients get their own domain, their own client portals, and their firm’s name out front. Multi-tenant underneath, single-tenant to the client.

What it unlocks

A boutique practice with platform-grade evidence and reporting.
No extra vendor on the client’s shelf.

Diligence surface

Cyber Cost of Deal, in three scenarios

Today it’s one scenario per deal. Q4 makes it three: buyer’s best case, buyer’s worst case, and the case named in the seller’s reps and warranties. Brand-impact costs fold into the same model, and the output prices straight into escrow and price-adjustment terms.

What changes for deal teams

Three numbers replace the argument over which assumptions to use.
Buyer’s counsel gets contract terms to drop in, not a memo to interpret.

Between quarters

Don’t wait for Q4’s recap.

We ship major products, new features and minor updates every week. Here’s where to catch them the day they land.

Weekly

Changelog

Every release, the week it goes out. What changed and who it’s for.

As it lands

Press

Launches, partnerships, and coverage, with the full announcement.

Any page

What’s new

The most recent, one click away in the top menu, wherever you are on the site.

Run it on your stack.

Everything above is live today. Book a walkthrough and a demo book shaped to your concerns lands in your inbox first.

Book a walkthrough Request the Q3 brief

We said three. We shipped fourteen.

Q3 timeline

Here’s what we shipped this quarter

Why these? Why now?

The calendar demanded it.

Autonomy needs a witness.

The pain wouldn’t wait.

Written this quarter.

An Eight-Hour Incident. Five Months to Count.

Here’s what we’re delivering in Q4

Trustworthy Autonomy™ opens to everyone

Operator white-label goes GA

Cyber Cost of Deal, in three scenarios

Don’t wait for Q4’s recap.

The Court Just Priced Pre-Close Control

Best AI Governance Platforms 2026

Third-Party Risk During a Portfolio Restructure

What is a vCISO? A Complete Guide to Virtual CISO Services, Costs, and How to Choose (2026)

Run it on your stack.