Built by operators, not observers.
The Pylon Group is an advisory and software studio led by a practicing CISO and CIO. We embed senior security and technology leaders into the seat, and we build the tools we wished existed when we ran those programs ourselves.
Why we built it.
Every security team and every CIO I have worked with has a version of the same complaint about their advisors and their tools. Strategy decks from people who left before the regulator showed up. Software roadmaps shaped by analyst surveys instead of the teams that have to live with the result.
I have spent the last two decades inside the role. As a Marine in cyber and communications. As a delivery leader for several cybersecurity and technology consulting firms. As CISO at Penn Medicine, Horizon Blue Cross Blue Shield of New Jersey, and Modernizing Medicine. As CIO and Chief Product Officer at Voyager Digital. I have written board memos under regulator pressure, sat through audit fieldwork with HHS and the SEC on the other side of the table, and signed off on post-incident reports.
Plenty of senior advisors have held the seat at some point. Several software products were started by former practitioners. What is rare is finding the same operator working the strategy deck, the audit defense, and the product roadmap, all three at once.
The advisory side embeds CISO-level and CIO-level operators into mid-market and PE-backed companies. The software side ships the tools we wished existed when we ran those programs ourselves: Scout for continuous third-party risk, Anvil for M&A and acquisition diligence, Command for the unified operating picture coming after that.
The two sides talk to each other on purpose. Advisory engagements feed the product roadmap. The product roadmap keeps the playbooks honest. Every feature in Pylon's software shipped because something was missing while we ran a real program. Every advisory playbook gets sharpened by what the software is teaching us in production.
If you have worked with consultants who left before the work got hard, or with platforms that were clearly designed far from the team running the program, we should talk.
Advisory plus software. One studio.
The Pylon Group operates one advisory practice and a portfolio of three products. Each one is shaped by the same operator's hand and the same practical bar.
Pylon Advisory
Embedded CISO, Embedded CIO, GRC program management, and AI engineering. Senior practitioners in the seat for 12 to 36 months, owning strategy, board reporting, and the technology decisions that follow.
See services →Continuous third-party risk.
An AI analyst that reads documents and assessments, a shared trust network where vendors maintain their profile once, continuous external monitoring, and supply chain visibility. Built for the security team that has stopped trusting their spreadsheet.
Explore Scout →M&A and acquisition diligence.
Document intelligence with pre-drafted outputs, control-by-control assessment, and the diligence workflow that PE firms and corporate acquirers actually run. Designed for the deal team and the security lead working the same target on the same week.
Explore Anvil →The unified operating picture.
A single command surface for the security and technology executive. The metrics, risks, and decisions that belong on the same screen instead of across seven dashboards. Currently in development.
See the brief →A 30-minute conversation, not a sales call.
Tell us what's on your plate. Advisory, software, or both. We will tell you whether Pylon is the right fit and what the first 90 days would look like if it is.
Start a Conversation