# Cyber Defense Group - **Type:** Advisory firm - **Website:** https://www.cdg.io - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A US firm in Pasadena, California, providing a part-time security leader (a virtual CISO), compliance help, incident response and managed security. ## Cyber Defense Group scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 3/5 Offers emergency incident response, a retainer, managed detection and response, forensics and regulatory notification support. Its pages name no responders and no incident case study; the about page says it has 'helped clients recover from disastrous breaches', a 2020 blog post says it 'helped recover from more than 100 data breaches', and the chief executive's biography says he has led incident response engagements. None of these gives details of a case. By default, the terms charge incident response from prepaid block hours, counted in half hours. Verified 2026-10-05. ### Qualifications of the people who do the work: 3/5 Two leaders are named with biographies that describe experience, and one blog post gives the chief operating officer's degrees. The PCI DSS and application security pages say assessors and engineers are 'certified', without naming anyone. One named staff member, Nick Harrahill, who signs as Director of Security Programs, says in a blog post that the author recently earned the IAPP AIGP certification. No security certification is stated for the two leaders. Verified 2026-10-05. ### What it publishes about fees: 4/5 A page for sales partners, last updated in September 2025, lists prices for five services: four reviews and assessments at $10,000 to $40,000 or more, and a 12-month managed security programme at $15,000 to $25,000 a month. The terms explain the billing (prepaid block hours, fixed-term subscriptions, half-hour steps). The page does not say what its prices leave out, no service page lists a price, and the partner reward plan on that page covered services sold by 31 December 2025. Clutch lists hourly rate and minimum project size as undisclosed. Verified 2026-10-05. ### Knowledge of your sector: 3/5 Sector sections on its case studies page for healthcare, retail, media and entertainment, finance and legal, a stated focus on regulated industries, and five named case studies, but no named sector specialists. Verified 2026-10-05. ### Independence from what it sells: 3/5 Mixed model: the firm sells advice and managed security; its terms say clients may choose to use its own software, such as its Blink service, and that it may recommend third party products, without saying whether it earns from them. A blog post for partners calls the firm 'vendor-agnostic'. These are disclosed on its own pages and in its terms; how advice is kept separate from what is sold is not. Verified 2026-10-05. ### Who carries the risk if the advice is wrong: 2/5 The terms cap liability at 12 months of fees, exclude indirect loss and promise work to generally accepted industry standards, but no professional indemnity cover is disclosed. Verified 2026-10-05. ## Sources for Cyber Defense Group Every line carries the page it was read on and the date it was checked. - California register, LLC: CYBER DEFENSE GROUP, LLC, number 201613210430, status Active, first filed 5 May 2016, registered office 177 E Colorado Blvd, Ste 200, Pasadena, CA 91105, agent Lou Rabon (as copied by OpenCorporates) - Source: https://opencorporates.com/companies/us_ca/201613210430 - Checked: 2026-10-05 - California register, Delaware corporation: Cyber Defense Group Inc, number 5099886, status Active, an out-of-state stock corporation and a branch of a Delaware company, same Pasadena address, agent Lou Rabon (as copied by OpenCorporates) - Source: https://opencorporates.com/companies/us_ca/5099886 - Checked: 2026-10-05 - Contract terms: The contracting company is Cyber Defense Group, Inc, a Delaware corporation. California (US) law governs and disputes go to courts in Los Angeles. Liability is limited to the fees paid or payable in the 12 months before the event, indirect and consequential loss is excluded, and the firm warrants that it will perform its services in a professional manner consistent with generally accepted industry standards - Source: https://www.cdg.io/terms-of-service/ - Checked: 2026-10-05 - Billing terms: Unless a statement of work says otherwise, fees are prepaid, non-refundable blocks of hours that expire, and incident response is charged from them. Billable time is counted in half hours. Subscriptions run for a fixed term with the fees spread across it. Invoices are due in 15 days - Source: https://www.cdg.io/terms-of-service/ - Checked: 2026-10-05 - Published prices: A page for its sales partners lists prices for five services: a 12-month managed security programme at $15,000 to $25,000 a month, a cloud security review at $20,000 to $30,000, a policy review and gap analysis at $10,000, a cybersecurity risk assessment at $30,000 to $40,000 or more, and an incident response capability assessment at $25,000. The same page says its partner reward plan covered services sold by 31 December 2025. The page was published in June 2024, and its metadata shows it was last updated on 3 September 2025 - Source: https://www.cdg.io/partner-spifftactular/ - Checked: 2026-10-05 - Service scope: Managed security services covering risk assessment, virtual CISO, incident response, AI governance and compliance, delivered as 'Outcomes-Based Security' programmes with fixed pricing - Source: https://www.cdg.io/services/cybersecurity-as-a-service/ - Checked: 2026-10-05 - Compliance services: Roadmaps and gap assessments for GDPR, HIPAA, SOC 2, ISO 27001 and more, with implementation to SOC 2, ISO 27001, HIPAA, NIST and CMMC; self-declared rather than independently verified - Source: https://www.cdg.io/services/compliance-services/ - Checked: 2026-10-05 - AI governance: Offers help to meet ISO 42001 and to build an AI governance framework, in a three-step process; self-declared rather than independently verified - Source: https://www.cdg.io/services/ai-governance/ - Checked: 2026-10-05 - Incident response: Emergency response, a retainer, managed detection and response with 12x5 monitoring, tabletop exercises and threat hunting, in a six-phase process based on NIST guidelines; the page names no responders and no incident case studies - Source: https://www.cdg.io/services/incident-response-services/ - Checked: 2026-10-05 - Forensic services: Digital forensics and eDiscovery, post-breach investigation with regulatory notification support and breach impact reporting, and litigation support with expert testimony; the page names no examiners - Source: https://www.cdg.io/forensic-services/ - Checked: 2026-10-05 - Leadership: The about page names founder and chief executive Lou Rabon, who says he set up the firm in 2016, and chief operating officer Gus Anagnos, with a biography for each; neither biography lists a professional qualification - Source: https://www.cdg.io/about/ - Checked: 2026-10-05 - Chief operating officer's degrees: A blog post of 6 March 2024 says the chief operating officer, Gus Anagnos, holds a bachelor's degree in finance from California State University, Long Beach, and an MBA from the USC Marshall School of Business - Source: https://www.cdg.io/blog/cyber-defense-group-welcomes-former-usc-ciso-gus-anagnos-as-coo-to-spearhead-hypergrowth-strategy/ - Checked: 2026-10-05 - Named client case studies: Five: EditShare, FilmRise, PacketFabric, Riva Health and PeerStreet. The same page has sections for healthcare, retail, media and entertainment, finance and legal - Source: https://www.cdg.io/success-stories/ - Checked: 2026-10-05 - Clutch: 4.7 out of 5 from 6 verified reviews, dated from 9 September 2022 to 2 June 2023, from named reviewers at PacketFabric, Riva Health, Borland-Groover Clinic and WideOrbit; the profile links to cdg.io, lists hourly rate and minimum project size as undisclosed, and gives $200,000 to $999,999 as the most common project size, based on 4 reviews - Source: https://clutch.co/profile/cyber-defense-group - Checked: 2026-10-05 - Insurance disclosure: No professional indemnity or errors and omissions cover is named on any public page read; the terms mention insurers only in the indemnification procedure - Source: https://www.cdg.io/terms-of-service/ - Checked: 2026-10-05 - Staff certifications: The PCI DSS assessment page says assessments come from 'certified QSAs' and are guided by 'certified PCI professionals'; it names no person - Source: https://www.cdg.io/pci-dss-assessment-services-contact/ - Checked: 2026-10-05 - Staff certifications, application security: The application security assessment page says testing is 'performed by certified AppSec engineers'; it names no person - Source: https://www.cdg.io/application-security-assessment-services-contact/ - Checked: 2026-10-05 - Named certification: A blog post of 10 September 2025, credited to Nick Harrahill, Director of Security Programs, says its author recently earned the IAPP Artificial Intelligence Governance Professional (AIGP) certification - Source: https://www.cdg.io/blog/ai-governance/ - Checked: 2026-10-05 - AI-use disclosure: The privacy policy, last updated 29 June 2026, says nothing about the firm's own use of AI - Source: https://www.cdg.io/privacy-policy/ - Checked: 2026-10-05 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Published - Indemnity cover: Not published - Credentials: Published - Independent accreditation: Not published - Client results: Published - How it uses AI: Not published ## Strengths - Names its leaders: founder and chief executive Lou Rabon, and chief operating officer Gus Anagnos, each with a short biography. - Publishes prices for five services on a page for its sales partners, such as $15,000 to $25,000 a month for a 12-month managed security programme. The page was last updated in September 2025. - Publishes five named client case studies, in media, cloud networking, digital health and real estate investing. - Has 4.7 out of 5 on Clutch from 6 verified client reviews, dated 2022 and 2023, including reviewers at PacketFabric, Riva Health, Borland-Groover Clinic and WideOrbit. ## Things to check Each one carries the factual basis it rests on. - Its published prices are on a page for its sales partners, last updated in September 2025. By default, its terms charge incident response from prepaid hours that expire and are not refundable. - Basis: A page for sales partners, published in June 2024 and last updated on 3 September 2025, lists prices for five services and says its SPIFF plan was valid for services sold by 31 December 2025, with a signed statement of work received before that date. No service page lists a price; the managed security pages say 'Fixed pricing', and the about page says 'fixed-cost basis'. A blog post on vCISO services says monthly retainers are 'often between $5,000 to $30,000 per month', a general market range rather than the firm's price. Terms of service, Schedule I: unless a statement of work says otherwise, fees are prepaid, non-refundable Block Time Hours that expire, and incident response is charged on that basis. Billable time is counted in half hours, subscriptions run for a fixed term, and invoices are due in 15 days. Clutch lists hourly rate and minimum project size as undisclosed. Verified 2026-10-05. - Its terms limit its liability to 12 months of fees, and it does not say whether it holds professional indemnity insurance. - Basis: Terms of service, clause 10.3: each party's total liability is limited to the fees paid or payable in the 12 months before the event, and lost profits, loss of data and indirect loss are excluded. The warranty is work in a professional manner to generally accepted industry standards. No professional indemnity or errors and omissions cover is named on any page read; the terms mention an indemnifying party's insurers only. Verified 2026-10-05. - Its about page lists no security certifications for its two named leaders. Two service pages say its assessors and engineers are certified, but name no one. - Basis: The about page names Lou Rabon (founder and chief executive) and Gus Anagnos (chief operating officer), with biographies that describe experience, not certifications. A blog post of 6 March 2024 gives the chief operating officer's degrees (a bachelor's in finance and an MBA). The PCI DSS assessment page says assessments come from 'certified QSAs' and the application security page says testing is 'performed by certified AppSec engineers'; neither names a person. A blog post of 10 September 2025, signed Nick Harrahill, Director of Security Programs, says the author recently earned the IAPP AIGP certification. No accreditation or membership is stated for the firm on the pages read. Verified 2026-10-05. - It sells advice and managed security, and its terms say clients may choose to use its own software. It does not say how it keeps its advice separate from what it sells. - Basis: The services pages offer virtual CISO advice, managed security, managed detection and response and incident response retainers. The terms say the firm may permit clients to use its own software as a service, such as its Blink service, that any such use is 'completely voluntary' (the product terms are in Schedule II), and that it may recommend third party products; they say nothing about earning from those recommendations. A blog post for partners says the firm is 'vendor-agnostic and outcome-first', which speaks to third party products, not to how its own advice and services are kept apart. No page read explains how advice is kept separate from what is sold. Verified 2026-10-05. ## Where this firm appears - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment) - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [After a cyber attack: what to report, and to whom](https://theassurancedesk.com/best/security-incident) - [Which data protection, AI governance and cyber security providers publish a price?](https://theassurancedesk.com/lists/providers-that-publish-a-price) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.