Questions, answered.

What is CISO of One?

CISO of One (cisoofone.com) is run by Utlyze and written for the one security lead at a small or mid-size company, or the IT lead who carries security, who now also answers for AI risk.

What is prompt injection?

Input that makes an AI system follow instructions it should not, whether typed by a user or hidden in a web page, file or email the model reads. OWASP lists it first in its 2025 Top 10 for LLM applications (LLM01:2025).

What is shadow AI?

Staff using AI tools the company has not approved. The main risk is company or customer data leaving your control through a tool nobody reviewed.

What is a fractional CISO or vCISO?

A part-time security leader who runs the security program for one or more companies. The terms are mostly used interchangeably. CISO of One does not replace that role; it works with whoever holds it on AI risk.

What should an AI security policy cover?

Approved tools, data that must never be pasted into them, sign-in through SSO with MFA, logging, and limits on what agents may do without a person’s approval. General education only; not security or legal advice.

How do teams secure AI agents that take actions?

Common practice: give each agent its own credentials with the least access it needs, require a person to approve payments, deletions and outside messages, review the tools it can call, and log what it does.

How do finance teams guard against deepfake voice fraud?

Widely used controls: verify any payment or bank-detail change by calling back on a number already on file, and require two people to approve it. A familiar voice alone is not proof. General education only.

What do Consult and Build cost?

Consult is $400 per hour, and each booking is at least 5 hours, or $2,000. Build is $15,000 a month. Each month, pick up to 5 business processes for our build-with-you coaches to work on. They build your AI systems with you and teach your team to run them. If you ever leave, the systems stay with you. Agents work only on your systems, and a shared 24/7 on-call rotation answers, with response times in writing.

How is this different from Business of One?

Business of One helps owners build and run an AI-first company. CISO of One is narrower: security and AI risk, meaning the controls, policies and incident plans a security lead answers for. Utlyze runs both, and both offer Consult and Build.

Is this security, legal or compliance advice?

No. Everything here is general education. It carries no guarantee about any outcome and does not replace qualified security, legal or compliance professionals who know your systems.