We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Cyber Defense Group review

Advisory firm

A US firm in Pasadena, California, providing a part-time security leader (a virtual CISO), compliance help, incident response and managed security.

Relevant if you are a growing company that wants a part-time security leader and help preparing for audits

Price Published
Indemnity cover Not published
How it uses AI Not published
Facts last checked

Not published means we did not find it on the firm's own pages.

Cyber Defense Group scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 3/5
Qualifications of the people who do the work 3/5
What it publishes about fees 4/5
Knowledge of your sector 3/5
Independence from what it sells 3/5
Who carries the risk if the advice is wrong 2/5

What Cyber Defense Group offers, and what it publishes

Cyber Defense Group is a US firm in Pasadena, California, founded in 2016. It sells virtual CISO services, compliance help for SOC 2, ISO 27001 and the US health law HIPAA, incident response, forensics and managed security. Its website names its leaders and publishes five named client case studies.

A page for its sales partners, last updated in September 2025, lists prices for five services, such as $15,000 to $25,000 a month for a 12-month managed security programme. Its service pages list no prices. By default, its terms charge incident response from prepaid hours that expire and are not refundable.

Its terms limit its liability to 12 months of fees, and it does not say whether it holds professional indemnity insurance. Its terms also say clients may choose to use its own software. On Clutch it has 4.7 out of 5 from 6 verified reviews, all from 2022 and 2023.

Strengths

  • Names its leaders: founder and chief executive Lou Rabon, and chief operating officer Gus Anagnos, each with a short biography.
  • Publishes prices for five services on a page for its sales partners, such as $15,000 to $25,000 a month for a 12-month managed security programme. The page was last updated in September 2025.
  • Publishes five named client case studies, in media, cloud networking, digital health and real estate investing.
  • Has 4.7 out of 5 on Clutch from 6 verified client reviews, dated 2022 and 2023, including reviewers at PacketFabric, Riva Health, Borland-Groover Clinic and WideOrbit.

Things to check

  • Its published prices are on a page for its sales partners, last updated in September 2025. By default, its terms charge incident response from prepaid hours that expire and are not refundable.
  • Its terms limit its liability to 12 months of fees, and it does not say whether it holds professional indemnity insurance.
  • Its about page lists no security certifications for its two named leaders. Two service pages say its assessors and engineers are certified, but name no one.
  • It sells advice and managed security, and its terms say clients may choose to use its own software. It does not say how it keeps its advice separate from what it sells.

Common questions

Does the firm publish its prices?

Yes, on a page for its sales partners, last updated in September 2025: for example, $15,000 to $25,000 a month for a 12-month managed security programme. Its service pages list no prices.

Does it offer SOC 2 or ISO 27001 readiness?

Yes. Its compliance page offers a roadmap for SOC 2 and ISO 27001, a check for gaps, and help to meet them.

Evidence for each Cyber Defense Group score

Show our working

Notes behind each thing to check

  • Its published prices are on a page for its sales partners, last updated in September 2025. By default, its terms charge incident response from prepaid hours that expire and are not refundable. (A page for sales partners, published in June 2024 and last updated on 3 September 2025, lists prices for five services and says its SPIFF plan was valid for services sold by 31 December 2025, with a signed statement of work received before that date. No service page lists a price; the managed security pages say 'Fixed pricing', and the about page says 'fixed-cost basis'. A blog post on vCISO services says monthly retainers are 'often between $5,000 to $30,000 per month', a general market range rather than the firm's price. Terms of service, Schedule I: unless a statement of work says otherwise, fees are prepaid, non-refundable Block Time Hours that expire, and incident response is charged on that basis. Billable time is counted in half hours, subscriptions run for a fixed term, and invoices are due in 15 days. Clutch lists hourly rate and minimum project size as undisclosed. Verified 2026-10-05.)
  • Its terms limit its liability to 12 months of fees, and it does not say whether it holds professional indemnity insurance. (Terms of service, clause 10.3: each party's total liability is limited to the fees paid or payable in the 12 months before the event, and lost profits, loss of data and indirect loss are excluded. The warranty is work in a professional manner to generally accepted industry standards. No professional indemnity or errors and omissions cover is named on any page read; the terms mention an indemnifying party's insurers only. Verified 2026-10-05.)
  • Its about page lists no security certifications for its two named leaders. Two service pages say its assessors and engineers are certified, but name no one. (The about page names Lou Rabon (founder and chief executive) and Gus Anagnos (chief operating officer), with biographies that describe experience, not certifications. A blog post of 6 March 2024 gives the chief operating officer's degrees (a bachelor's in finance and an MBA). The PCI DSS assessment page says assessments come from 'certified QSAs' and the application security page says testing is 'performed by certified AppSec engineers'; neither names a person. A blog post of 10 September 2025, signed Nick Harrahill, Director of Security Programs, says the author recently earned the IAPP AIGP certification. No accreditation or membership is stated for the firm on the pages read. Verified 2026-10-05.)
  • It sells advice and managed security, and its terms say clients may choose to use its own software. It does not say how it keeps its advice separate from what it sells. (The services pages offer virtual CISO advice, managed security, managed detection and response and incident response retainers. The terms say the firm may permit clients to use its own software as a service, such as its Blink service, that any such use is 'completely voluntary' (the product terms are in Schedule II), and that it may recommend third party products; they say nothing about earning from those recommendations. A blog post for partners says the firm is 'vendor-agnostic and outcome-first', which speaks to third party products, not to how its own advice and services are kept apart. No page read explains how advice is kept separate from what is sold. Verified 2026-10-05.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 3/5 Offers emergency incident response, a retainer, managed detection and response, forensics and regulatory notification support. Its pages name no responders and no incident case study; the about page says it has 'helped clients recover from disastrous breaches', a 2020 blog post says it 'helped recover from more than 100 data breaches', and the chief executive's biography says he has led incident response engagements. None of these gives details of a case. By default, the terms charge incident response from prepaid block hours, counted in half hours. Verified 2026-10-05.
Qualifications of the people who do the work 3/5 Two leaders are named with biographies that describe experience, and one blog post gives the chief operating officer's degrees. The PCI DSS and application security pages say assessors and engineers are 'certified', without naming anyone. One named staff member, Nick Harrahill, who signs as Director of Security Programs, says in a blog post that the author recently earned the IAPP AIGP certification. No security certification is stated for the two leaders. Verified 2026-10-05.
What it publishes about fees 4/5 A page for sales partners, last updated in September 2025, lists prices for five services: four reviews and assessments at $10,000 to $40,000 or more, and a 12-month managed security programme at $15,000 to $25,000 a month. The terms explain the billing (prepaid block hours, fixed-term subscriptions, half-hour steps). The page does not say what its prices leave out, no service page lists a price, and the partner reward plan on that page covered services sold by 31 December 2025. Clutch lists hourly rate and minimum project size as undisclosed. Verified 2026-10-05.
Knowledge of your sector 3/5 Sector sections on its case studies page for healthcare, retail, media and entertainment, finance and legal, a stated focus on regulated industries, and five named case studies, but no named sector specialists. Verified 2026-10-05.
Independence from what it sells 3/5 Mixed model: the firm sells advice and managed security; its terms say clients may choose to use its own software, such as its Blink service, and that it may recommend third party products, without saying whether it earns from them. A blog post for partners calls the firm 'vendor-agnostic'. These are disclosed on its own pages and in its terms; how advice is kept separate from what is sold is not. Verified 2026-10-05.
Who carries the risk if the advice is wrong 2/5 The terms cap liability at 12 months of fees, exclude indirect loss and promise work to generally accepted industry standards, but no professional indemnity cover is disclosed. Verified 2026-10-05.

Sources for Cyber Defense Group

  • California register, LLC: CYBER DEFENSE GROUP, LLC, number 201613210430, status Active, first filed 5 May 2016, registered office 177 E Colorado Blvd, Ste 200, Pasadena, CA 91105, agent Lou Rabon (as copied by OpenCorporates) (opencorporates.com, checked 5 October 2026)
  • California register, Delaware corporation: Cyber Defense Group Inc, number 5099886, status Active, an out-of-state stock corporation and a branch of a Delaware company, same Pasadena address, agent Lou Rabon (as copied by OpenCorporates) (opencorporates.com, checked 5 October 2026)
  • Contract terms: The contracting company is Cyber Defense Group, Inc, a Delaware corporation. California (US) law governs and disputes go to courts in Los Angeles. Liability is limited to the fees paid or payable in the 12 months before the event, indirect and consequential loss is excluded, and the firm warrants that it will perform its services in a professional manner consistent with generally accepted industry standards (cdg.io, checked 5 October 2026)
  • Billing terms: Unless a statement of work says otherwise, fees are prepaid, non-refundable blocks of hours that expire, and incident response is charged from them. Billable time is counted in half hours. Subscriptions run for a fixed term with the fees spread across it. Invoices are due in 15 days (cdg.io, checked 5 October 2026)
  • Published prices: A page for its sales partners lists prices for five services: a 12-month managed security programme at $15,000 to $25,000 a month, a cloud security review at $20,000 to $30,000, a policy review and gap analysis at $10,000, a cybersecurity risk assessment at $30,000 to $40,000 or more, and an incident response capability assessment at $25,000. The same page says its partner reward plan covered services sold by 31 December 2025. The page was published in June 2024, and its metadata shows it was last updated on 3 September 2025 (cdg.io, checked 5 October 2026)
  • Service scope: Managed security services covering risk assessment, virtual CISO, incident response, AI governance and compliance, delivered as 'Outcomes-Based Security' programmes with fixed pricing (cdg.io, checked 5 October 2026)
  • Compliance services: Roadmaps and gap assessments for GDPR, HIPAA, SOC 2, ISO 27001 and more, with implementation to SOC 2, ISO 27001, HIPAA, NIST and CMMC; self-declared rather than independently verified (cdg.io, checked 5 October 2026)
  • AI governance: Offers help to meet ISO 42001 and to build an AI governance framework, in a three-step process; self-declared rather than independently verified (cdg.io, checked 5 October 2026)
  • Incident response: Emergency response, a retainer, managed detection and response with 12x5 monitoring, tabletop exercises and threat hunting, in a six-phase process based on NIST guidelines; the page names no responders and no incident case studies (cdg.io, checked 5 October 2026)
  • Forensic services: Digital forensics and eDiscovery, post-breach investigation with regulatory notification support and breach impact reporting, and litigation support with expert testimony; the page names no examiners (cdg.io, checked 5 October 2026)
  • Leadership: The about page names founder and chief executive Lou Rabon, who says he set up the firm in 2016, and chief operating officer Gus Anagnos, with a biography for each; neither biography lists a professional qualification (cdg.io, checked 5 October 2026)
  • Chief operating officer's degrees: A blog post of 6 March 2024 says the chief operating officer, Gus Anagnos, holds a bachelor's degree in finance from California State University, Long Beach, and an MBA from the USC Marshall School of Business (cdg.io, checked 5 October 2026)
  • Named client case studies: Five: EditShare, FilmRise, PacketFabric, Riva Health and PeerStreet. The same page has sections for healthcare, retail, media and entertainment, finance and legal (cdg.io, checked 5 October 2026)
  • Clutch: 4.7 out of 5 from 6 verified reviews, dated from 9 September 2022 to 2 June 2023, from named reviewers at PacketFabric, Riva Health, Borland-Groover Clinic and WideOrbit; the profile links to cdg.io, lists hourly rate and minimum project size as undisclosed, and gives $200,000 to $999,999 as the most common project size, based on 4 reviews (clutch.co, checked 5 October 2026)
  • Insurance disclosure: No professional indemnity or errors and omissions cover is named on any public page read; the terms mention insurers only in the indemnification procedure (cdg.io, checked 5 October 2026)
  • Staff certifications: The PCI DSS assessment page says assessments come from 'certified QSAs' and are guided by 'certified PCI professionals'; it names no person (cdg.io, checked 5 October 2026)
  • Staff certifications, application security: The application security assessment page says testing is 'performed by certified AppSec engineers'; it names no person (cdg.io, checked 5 October 2026)
  • Named certification: A blog post of 10 September 2025, credited to Nick Harrahill, Director of Security Programs, says its author recently earned the IAPP Artificial Intelligence Governance Professional (AIGP) certification (cdg.io, checked 5 October 2026)
  • AI-use disclosure: The privacy policy, last updated 29 June 2026, says nothing about the firm's own use of AI (cdg.io, checked 5 October 2026)

Seeking ISO 42001 certificationRegulated sectorsFirst DPO or AI policyAfter a ransomware or security incident

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.