J.R. Cunningham has been in security since before the industry had a name for itself. “We didn’t call it cybersecurity, we didn’t call it information security,” he says. “We were all IT people and someone said, hey, maybe someone should try and figure out how to protect all this stuff.” Thirty years later, his scorecard is short. “If you ask the question, have breaches become less frequent, less expensive, less severe in the last 30 years, the answer is nope.”
Cunningham, Vice President, Professional Services at DeepSeas, talked to Cynomi for its Chess Masters series, which runs alongside the 2026 State of vCISO Report. The report surveyed 200 service providers and 200 IT and security decision-makers and practitioners at organizations that use an outside provider. Among the clients using a managed detection and response (MDR) provider, none said the service fully meets their strategic advisory needs. Cunningham’s answer to that gap is to run managed security and advisory as one engagement.
Managed Security and Advisory Are One Motion
Part of the reason, he says, is that the two sides of the business kept their distance by design. “Consultants would fold their arms and say, I’m not selling managed services, I’m not selling anything. I’m going to go give my opinion and then leave. And managed security services would do the same thing. They would say, I’m not here to consult with you on your problems. I’m here to run devices or monitor logs.”
The SOC would ask how many devices a client had, quote the job, and win the deal. “And then a year later they would call you and they would say, I’m really mad at you because you didn’t detect that pen test that just happened to me.”
“Those are not, and cannot be, separate motions today,” Cunningham says. “We have to treat managed security services and professional services as part of the client cybersecurity journey.” At DeepSeas, that journey starts with a baseline, and the Strategic Security Advisory team owns it. “Step one is where are you today, and obviously that’s where we use Cynomi to great advantage.” Then: “That leads to the roadmap of what services are we going to put in front of you, what further consulting do you need.”
The Risk Equation Comes Before the Service Catalog
Ask Cunningham how DeepSeas scopes an engagement and he tells you about a zoo. He once assessed one and found it strong on physical security and weak on privacy and payment card controls. “It turns out that when polar bears eat the customer, it’s a really bad day. And so they focused everything on physical security. And that was exactly the right move for them.”
“Before you can manage security for a customer, you kind of have to understand the risk equation. What are the threats? What are the consequences? What are the liabilities? What do they need to deal with? You have to put that all down in some sort of a security battle plan.”
Client requirements used to arrive fully formed, down to the number of endpoints and firewalls. “That’s not true today. The clients come to us with these very ambiguous requirements, like help me with data protection, help me with privacy, help me with I’m scared about ransomware.” Getting from a worry to a scoped service means understanding the business and the adversaries it attracts. “We have to understand where a client is in their business journey before we can even start to ever sell them anything in cybersecurity.”
Cunningham puts the bar this way: “We don’t earn the right to solve a problem for the customer unless we can describe exactly what that problem is, who the threat actors are, and what we think they should do.” The answer is a product some of the time, and the rest of the time it is a broken HR procedure or a policy that is broken. “The product companies go, whoa, we don’t want you talking about policy, standards, and procedures. We want you selling blinky lights.”
Compliance Drives the Budget. Which Ten Controls Deserve It?
“As a practitioner, it pains me that this is true, but compliance drives the overwhelming majority of security spending. Companies spend on security because they have to.”
Within any standard, a handful of controls deserve real money and the rest deserve a checkmark. “Nobody can afford to be highly mature at 200 or so security controls. So which 10? That becomes the question. And it’s different for every industry, it’s different for different organizations.”
For a retailer, that means meeting the PCI DSS minimum, then getting good at network segmentation and cardholder data protection. For a small urgent care clinic, it is multi-factor authentication on the patient portal, vulnerability management, segmentation, and managed detection, measured over time. “A 10,000-bed hospital system has a completely different problem set than an individual clinic.” And yet: “The consequence to the victim is the same every single time.”
Proof of Progress Is the Renewal Conversation
There is a question MSSP clients ask constantly. “Clients want to know, what am I getting for what I’m paying for? That’s a constant question that MSSP clients have. I didn’t hear from you this month. Why?” Silence from an MDR team can mean a quiet month or a provider doing nothing, and the client cannot tell which.
Providers in the survey estimate that 56% of their clients ask for strategic guidance beyond fixing technical issues, yet 70% name the quarterly business review as their primary way of delivering it. A client who hears from their provider four times a year has to guess what happened in between.
Advisory wrapped around the managed service gives the client a before and an after. “We can make a recommendation, we can take a snapshot of where they’re at, and then later we can say, hey, I made this recommendation and here’s how much better you are.” A quiet month then reads as evidence. “If I say to a client, you know what, you didn’t hear from the SOC in the last month because no polar bears ate the customers, you’re in a really good spot. That’s a way better position to be in than, I signed up with this MSSP and I didn’t hear from them for a month.”
When the clients in Cynomi’s survey decide whether to renew or expand, better risk visibility (47%) and more strategic security advice (41%) are their top two reasons. And 95% say they would be more likely to increase their overall security spend if their provider offered more proactive planning and strategic guidance. “You can’t have a good assessment unless you’re using a really good platform that’s solid and repeatable, because that’s how you show the client, I gave you this advice and you’re getting better over time, or you’re not.”
The One Move: Meet the Client Where They Are
Erin McLean, Cynomi’s Chief Marketing Officer, closed the interview by asking what one move a service provider should make this year to start playing chess instead of checkers. “Meet the client where they are,” Cunningham said. “We in our industry have been so guilty of having a very prescriptive approach that says, this will solve your problems.”
DeepSeas sequences the work from simple problems to complex ones. “You solve the simple problems, take some of the risk away, and then you get the right to solve some of the tricky, complex problems.” A shared measuring stick keeps the provider honest. “If we have the same measuring stick and we’re meeting clients where they are, and we’re measuring where they’re at, and then we’re making meaningful recommendations, number one, we’re not going to sell them things that don’t take risk away. And that’s the scary thing: you sell a client something in our industry and a month later they get breached, they hate you.”
Cunningham compares the job to healthcare. “It’s more like healthcare than law enforcement. The law enforcement side is, we’re going to stop the bad guys from doing the bad things. But the healthcare side is more, how healthy are you? What can we do for you?”
The client can tell the difference. “You have to be credible and trusted with the client. They have to know that you’re playing chess.”
The baseline and the progress record come from Cynomi. DeepSeas runs the model on top of it, with advisory programs that scale from office hours to a full-time advisor alongside its MDR service. Watch the full interview with J.R. Cunningham above, and download the 2026 State of vCISO Report.
Table of contents
