Frequently asked questions

A: Use the contact form on this site and choose the type of inquiry, or message Dan on LinkedIn (linkedin.com/in/cisodan). For consulting, a line or two on your organization's size, industry and main security or AI challenge helps him come back with something useful.

A: Yes. Qualified organizations can book a free 30-minute discovery call. It's a no-pressure conversation about your goals and challenges, so you both can decide whether working together makes sense before anything formal starts.

A: More than 22 years in the U.S. Air Force and Air National Guard taught Dan to treat security as a mission: know what you're protecting, plan for the bad day, and make sure someone owns each risk. He brings that same discipline to security programs, incident response planning and team culture, while keeping the advice practical for organizations that don't run like the military.

A: Yes. Dan works with aerospace and defense suppliers and other organizations in regulated, mission-critical sectors. That includes CMMC and NIST readiness, protecting sensitive data, and building security programs that hold up to customer and government scrutiny.

A: Dan has published 60+ contributions with Forbes Technology Council, including bylined articles and Expert Panel features, on AI governance, threat intelligence and security leadership. He is co-author of Advanced Cyber Threat Intelligence and Hunting (Packt) and The AI Mindset, an editor of the Geneva Manual on Cyber Threat Intelligence, and a core team member of the OWASP AI Exchange. The Publications page and his LinkedIn have the latest.

A: Yes. Dan speaks at conferences, panels, executive briefings and podcasts on AI governance and security, threat intelligence, the vCISO model and the business case for incident response. Use the contact form, choose speaking/media, and include the date, audience and format.

A: Dan is a PhD candidate in Cybersecurity Leadership at Capitol Technology University, researching the return on investment of incident response in aerospace. He pairs that with 22+ years of military cyber experience, hands-on work as a fractional vCISO, and frameworks including NIST RMF, NIST AI RMF, ISO 27001, ISO/IEC 42001, CMMC, HIPAA and the EU AI Act. He is also a TÜV SÜD authorized instructor.

A: AI governance is the set of policies, roles and controls that decide how an organization adopts and runs AI: who approves it, what data it can touch, how it's tested and who owns the risk. Done well, it lets you move faster with AI while avoiding legal exposure, data leaks and attacks like prompt injection and data poisoning. Frameworks such as NIST AI RMF, ISO/IEC 42001 and the EU AI Act give it structure.

A: It depends on how you use them. Enterprise versions of these tools can be used safely with the right guardrails; the risk usually comes from staff pasting sensitive data into personal accounts, unclear vendor data terms, and no one owning the decision. Dan helps organizations assess the tools, set an acceptable use policy, review vendor security and put controls in place before broad rollout.

A: Regulated small and mid-sized businesses, aerospace and defense suppliers, and critical infrastructure operators that need senior security leadership without a full-time CISO. Typical drivers are AI adoption risk, compliance requirements (HIPAA, NIST, ISO 27001, CMMC), or building a security program that customers and auditors will trust.

A: Yes. The startup stage is the cheapest time to build security in rather than bolt it on later. Dan helps founders choose and govern AI tools sensibly, set up a right-sized security program, and get ready for the security questionnaires, SOC 2 or ISO 27001 audits that enterprise customers ask for.

A: Dan Sorensen is a fractional vCISO and AI governance advisor and the founder of Nexus Security Advisors. He spent 22+ years in U.S. Air Force and Air National Guard cyber operations, writes for Forbes Technology Council, serves on the OWASP AI Exchange core team, co-authored two books on AI and cyber threat intelligence, and is a PhD candidate in Cybersecurity Leadership at Capitol Technology University.

A: Dan's background, his writing on AI governance, threat intelligence and security leadership, his books, speaking topics, and how to work with him. For consulting delivered through his firm, see Nexus Security Advisors (nexussecurityadvisors.com).

A: Client information is treated as confidential. Engagements can be covered by a non-disclosure agreement, access is limited to what the work needs, and Dan follows the same security practices he recommends to clients. Details you send through this site's contact form are used only to respond to your inquiry and are never sold or shared for marketing.

A: The Publications page on this site has his blog posts, and the Latest on Forbes list links to his Forbes Technology Council articles. His books are on Amazon, and he shares shorter takes on AI governance, the vCISO model and threat intelligence on LinkedIn.

A: Through Nexus Security Advisors, Dan offers fractional vCISO leadership, AI governance and AI risk assessments, compliance readiness (NIST, ISO 27001, ISO/IEC 42001, CMMC, HIPAA, EU AI Act), cyber threat intelligence and incident response planning, and executive and board advisory. He also teaches and trains teams, and speaks on these topics.

A: He starts by finding where AI is actually in use, including tools staff adopted on their own, then assesses the risks using the OWASP AI Exchange and NIST AI RMF: data leakage, prompt injection, model and supply chain risk, and over-reliance on outputs. From there he helps put the right controls, policies and ownership in place so AI can be used with confidence.