Echelon Risk + Cyber
Procurement partnerAbout
Echelon Risk + Cyber is a cybersecurity consulting firm and managed security service provider (MSSP) that delivers offensive security, defensive security, compliance, and risk advisory services to organizations across regulated industries. The firm serves clients in financial services, healthcare, higher education, manufacturing, sports and entertainment, and defense, among others. Echelon operates as a long-term cybersecurity partner, offering both project-based engagements and ongoing managed ...
Details
VenSearch Intelligence
Ideal Customer
- Echelon's stated sweet spot is mid-market organizations with 50–2,500 employees operating in highly regulated industries such as healthcare, financial services, defense contracting, and technology/SaaS.
- Their vCISO-Led Security Team as a Service (STaaS) model is specifically designed for organizations that have outgrown basic security tools but cannot justify the cost of a full-time internal CISO or security team.
Key Differentiators
- Echelon's primary differentiation is its vCISO-Led Security Team as a Service (STaaS) model, which bundles executive security leadership with full-stack execution across offensive testing, defensive hardening, and GRC — rather than delivering advisory alone or tooling alone.
- They position themselves as a 'strategic security partner' rather than a niche point-solution vendor, emphasizing a risk-based, business-outcome-focused approach that resonates with CFOs and boards.
Industries Served
- Echelon serves a broad set of verticals with particular depth in highly regulated industries.
- Specifically named industry pages and service specializations cover healthcare (HIPAA, HITRUST), financial services (FFIEC, SEC), defense industrial base (CMMC 2.0), technology and SaaS (SOC 2), manufacturing, higher education, professional services, retail, sports and entertainment, not-for-profit, and government.
Service Coverage
- Echelon Risk + Cyber is headquartered in Pittsburgh, PA, and operates across North America, with its primary client base in the United States.
- The firm serves clients nationally rather than only regionally, with a distributed consulting and SOC delivery team, and participates in master agent channels through Telarus, Avant, and Scan Source that extend its reach further.
Partnerships
- Echelon maintains deep technology partnerships with CrowdStrike (Elevate Partner Program member and named launch partner in CrowdStrike's Services Partner Program, and one of only a small number of proactive strategic services partners), Drata (formal service partner for GRC automation and SOC 2/ISO 27001 implementations), Microsoft (referenced as a strategic partner for M365 and GCC High environments), Palo Alto Networks, Zscaler, Vanta, and Panorays.
- For third-party risk management, Echelon uses Panorays as a platform partner.
Company Size & Ownership
- Echelon Risk + Cyber was founded in 2021 by Dan Desko, who serves as Founder, CEO, and Managing Partner, with Matt Donato and Eric Bronack (Partner and COO) also in leadership.
- Headcount has grown from approximately 15 employees at founding to roughly 83–86 employees as of mid-2026, representing approximately 23% year-over-year growth and 36.5% growth over two years.
Compliance & Certifications
- Echelon operates as a CMMC Registered Provider Organization (RPO) with certified Registered Practitioners on staff, enabling them to guide DoD contractors through CMMC Level 2 compliance.
- Staff hold certifications including CISSP, CISA, CRISC, CMMC-RP, GWAPT, PCIP, and ISO 27001 Senior Lead Implementer credentials.
Compiled from public sources by VenSearch · Last researched October 13, 2026
Offerings
42 offeringsActive Directory Security Assessment (ADSA)
A targeted assessment of an organization's Active Directory environment to identify misconfigurations, privilege escalation paths, and other security weaknesses that attackers commonly exploit. Provides actionable findings and remediation guidance to harden the AD environment.
AI Governance
Advisory services to help organizations build and manage AI governance programs aligned to frameworks such as ISO 42001 and the NIST AI Risk Management Framework. Covers risk assessment, policy and procedure development, ethical AI use, and compliance with emerging AI regulations.
AI Secure
A comprehensive managed AI security program that helps organizations embrace AI with confidence by building guardrails around AI development, deployment, and vendor use. Designed to ensure AI initiatives are secure, ethical, and compliant from day one, whether organizations are building their own models or integrating third-party AI tools.
AWS Security Assessment
Evaluates an organization's Amazon Web Services environment against security best practices to identify gaps and provide a remediation roadmap. The process includes assessment planning and scoping, an in-depth security review covering all security domains, and post-assessment remediation and support activities such as configuration adjustments and license structure review.
Business Continuity + Disaster Recovery (BCDR)
Helps organizations develop and maintain customized business continuity and disaster recovery plans to minimize downtime and protect critical data during unexpected disruptions. Services include identifying critical assets, assessing potential risks, developing actionable recovery plans, and building resilience against ransomware and other disruptive incidents.
Cloud Security Assessment
A broad assessment of cloud environments to identify security vulnerabilities, misconfigurations, and compliance gaps across cloud platforms. Provides a clear remediation roadmap to improve the overall cloud security posture.
CMMC 2.0 Compliance
Guides Department of Defense contractors through all phases of CMMC Level 2 compliance as a Registered Provider Organization (RPO) with certified Registered Practitioners. Services include scope definition, gap assessment against NIST 800-171, remediation strategy, pre-audit assessment, C3PAO coordination, and continuous compliance support. Also assists with Microsoft GCC High environment configuration for DoD compliance.
CrowdStrike Platform Services
Implementation and management services for the CrowdStrike Falcon platform, including Next-Gen SIEM implementation and migration. Echelon helps clients modernize their detection capabilities and gain better visibility across their environment through structured delivery and deep expertise with the CrowdStrike platform.
Cybersecurity Awareness Training
Security awareness training programs designed to educate employees on cybersecurity threats and best practices. Helps organizations reduce human-factor risks by building a security-conscious workforce.
Defensive Controls Assessment
Provides a data-backed evaluation of an organization's security defenses using Echelon's Cyber Posture Map and industry frameworks including NIST and MITRE ATT&CK. Uncovers gaps and redundancies in defensive controls and provides guidance to strengthen protection and improve organizational resilience.
Defensive Security + Hardening
Services focused on strengthening an organization's existing security controls and reducing attack surface through configuration hardening, security architecture review, and implementation of defensive measures. Designed to reduce risk and improve resilience against known and emerging threats.
FFIEC Compliance
Provides right-sized compliance and risk management services for financial institutions subject to FFIEC interagency guidance and oversight from agencies such as the FRB, OCC, FDIC, NCUA, and CFPB. Services include IT audit outsourcing and co-sourcing, cybersecurity assessments using the FFIEC Cybersecurity Assessment Tool, penetration testing, vulnerability assessments, social engineering exercises, third-party risk management, and business continuity management.
GRC-as-a-Service (GRCaaS)
An all-in-one ongoing managed service that builds, manages, and scales an organization's governance, risk, and compliance program with a dedicated Echelon team. Covers continuous compliance management, policy creation and updates, ongoing risk assessments, third-party risk management, and incident response planning, replacing the need for full-time GRC staff.
HIPAA Compliance Services
Helps healthcare organizations and business associates achieve and maintain HIPAA compliance by securing electronic protected health information (ePHI). Services include HIPAA risk and gap assessments using HHS OCR audit protocol, cloud security and data residency guidance, third-party risk management, and incident response planning tailored to healthcare environments. Also offered as an ongoing GRC-as-a-Service engagement.
Incident Response Plan + Tabletop Exercises
Develops tailored incident response playbooks and conducts realistic tabletop exercises (TTXs) to evaluate an organization's preparedness for security breaches. Exercises are designed to align both technical teams and executive leadership and help organizations practice coordinated, effective responses to real-world cyber threats.
ISO 27001 Compliance
Supports organizations through the full ISO 27001 certification journey, from initial gap assessment through implementation, internal audit, and certification. Delivered by Certified Information Security Auditors and ISO 27001 Senior Lead Implementers using a proprietary methodology. Services include ISMS portal creation, control implementation, policy development, risk assessment and treatment plans, and ongoing certification maintenance.
IT Security Audit
Comprehensive information technology audit services that evaluate an organization's IT risk posture against industry standards and regulatory requirements. Can be delivered as outsourced IT audit, co-sourced audit, or special project engagements, and supports requirements from regulators such as the FFIEC.
Managed Cloud Security Services
Ongoing managed security services specifically focused on protecting cloud environments. Provides continuous monitoring, security configuration management, and risk mitigation for cloud-hosted infrastructure and workloads.
Managed Detection + Response, Powered by CrowdStrike
A managed detection and response service built on the CrowdStrike Falcon platform that provides continuous monitoring, threat detection, and incident response for client environments. Echelon's team leverages CrowdStrike's Next-Gen SIEM and Falcon platform capabilities to provide enhanced visibility and faster detection across the environment.
Managed Firewall Services
Managed service providing ongoing configuration, monitoring, and management of firewall infrastructure to protect client network perimeters. Ensures firewall rules and policies remain current and effective against evolving threats.
Managed Microsoft 365 Security Services
Ongoing management and monitoring of Microsoft 365 environments to ensure proper security configuration, detect threats, and maintain a strong security posture. Addresses common misconfigurations and security gaps in Microsoft 365 deployments.
Managed Security Services (MSSP)
An ongoing managed security program that provides organizations with continuous cybersecurity monitoring, detection, and response capabilities without requiring a full in-house security team. Includes services such as managed detection and response powered by CrowdStrike, managed defensive cybersecurity, managed cloud security, managed vulnerability and threat management, managed Microsoft 365 security, managed firewall services, and business continuity and disaster recovery.
Managed Vulnerability + Threat Management
A managed service that continuously identifies, prioritizes, and helps remediate vulnerabilities across client environments. Combines vulnerability scanning and threat intelligence to keep organizations ahead of emerging risks on an ongoing basis.
Microsoft 365 Security Assessment
An assessment of an organization's Microsoft 365 environment to identify security gaps, misconfigurations, and compliance issues. Provides recommendations to strengthen security controls within the M365 platform.
Next Gen Antivirus (NGAV)
Deployment and management of next-generation antivirus solutions that go beyond signature-based detection to protect endpoints against advanced and unknown threats. Provides enhanced endpoint protection as part of a broader defensive security program.
Offensive Security + Adversary Simulation
A suite of offensive security services that simulate real-world attacker techniques to uncover vulnerabilities across an organization's systems, networks, and people. Includes penetration testing for PCI, web applications, mobile, and cloud environments, as well as red teaming, purple teaming, social engineering attacks, war gaming, and Active Directory security assessments.
Operational Technology Security Services
Cybersecurity services specifically designed to protect operational technology (OT) environments such as industrial control systems and critical infrastructure. Addresses the unique security challenges and risk exposure of OT systems that differ from traditional IT environments.
PCI DSS Penetration Testing
Delivers penetration testing specifically aligned to PCI DSS 4.0.1 Requirement 11.4, covering internal testing, external testing, segmentation validation, and multi-tenant environment support. Testing is performed by independent, qualified professionals to provide credible audit evidence and validate that cardholder data environments are properly protected. Also supports post-change testing requirements.
Penetration Testing for SOC 2, CMMC, PCI DSS
Provides compliance-driven penetration testing services aligned to SOC 2, CMMC, and PCI DSS requirements. Testing covers internal and external systems, web applications, mobile applications, and cloud environments, and includes segmentation testing and post-change testing. Delivered by qualified, independent testers to meet audit and certification requirements.
Purple Teaming Services
Collaborative engagements where offensive and defensive security teams work together to simulate attacks and improve detection and response capabilities in real time. Purple teaming bridges the gap between red team findings and blue team improvements to maximize security program effectiveness.
Red Teaming
Simulated adversary attack campaigns that test an organization's detection and response capabilities against realistic, multi-stage attack scenarios. Red team engagements go beyond standard penetration tests to evaluate the effectiveness of people, processes, and technology in detecting and responding to sophisticated threats.
Risk Advisory + GRC
A comprehensive governance, risk, and compliance service that helps organizations build and manage security programs aligned to industry standards and regulatory frameworks. Offered in both project-based and ongoing GRC-as-a-Service models, covering gap assessments, policy development, risk assessments, and third-party risk evaluations. Supports frameworks including NIST, ISO 27001, CMMC, SOC 2, HIPAA, PCI DSS, and others.
SOC 2 Automation
Through a partnership with a leading SOC 2 automation and compliance platform, Echelon helps clients automate large portions of their SOC 2 compliance program, including integrations with business platforms such as ERP, HRIS, cloud platforms, and SSO. The platform includes a risk assessment tool, cybersecurity training module, and onboarding process automation, reducing compliance-related engineering and back-office hours by an average of 500+ hours per year.
SOC 2 Readiness Assessment + Enablement
Prepares SaaS organizations and other service providers for SOC 2 compliance by evaluating current technology controls against the SOC 2 framework across people, processes, and technology. Services include readiness gap assessments, remediation strategy and support, SOC 2 automation platform implementation, pre-audit assessment, and audit support including audit firm selection and evidence management. Ongoing vCISO support is available post-certification.
Social Engineering Attacks
Simulated phishing, pretexting, and other social engineering campaigns designed to test employee susceptibility to manipulation-based attacks. Results are used to identify training gaps and strengthen the human layer of an organization's security program.
Third Party Risk Management (TPRM) Services
Helps organizations identify, assess, mitigate, and monitor cybersecurity risks introduced by vendors and third-party service providers. Offerings include TPRM program maturity assessments, assessment scoping, remediation support, TPRM strategy development, TPRM-as-a-Service, technology platform implementations, and a vendor intelligence center that gathers and interprets vendor-related risk data. Supports regulatory compliance requirements across industries including healthcare and financial services.
Threat Hunting
Proactive search through an organization's environment to detect hidden threats, malicious activity, or indicators of compromise that have evaded automated security controls. Combines human expertise with threat intelligence to uncover advanced threats before they cause damage.
TPRM as a Service
A fully managed third-party risk management offering where Echelon performs the ongoing operations of a client's TPRM program, including assessment distribution and review, specialized assessments, due diligence activities such as SOC report review and SIG analysis, risk remediation, continuous monitoring, and reporting. Allows organizations to outsource the heavy lifting of their vendor risk management program.
TPRM Technology Implementations
Implements end-to-end third-party risk management technology platforms tailored to an organization's unique TPRM program. Services include business and functional requirement development, process design, tool configuration, data ingestion, organizational training, and ongoing support.
vCISO-Led Security Team as a Service (STaaS)
Provides organizations with a fractional Chief Information Security Officer (vCISO) leading a full security team, giving access to senior cybersecurity leadership and execution capabilities without a full-time executive hire. The vCISO team handles security strategy, governance, risk assessments, compliance oversight, security awareness training, and ongoing program management. Designed for organizations that need cyber support without a full-time hire.
Vulnerability Management
Identifies, prioritizes, and tracks vulnerabilities across an organization's IT environment to reduce exposure and guide remediation efforts. Provides ongoing visibility into the vulnerability landscape with actionable guidance for risk reduction.
War Gaming
Structured security exercises that simulate cyber attack scenarios to test an organization's strategic and tactical decision-making under pressure. Helps leadership and security teams practice coordinated response to complex, realistic cyber events.
Considering Echelon Risk + Cyber?
Our team will work with you to determine if Echelon Risk + Cyber is the right fit for your organization. From research and assessment through procurement negotiation and ongoing vendor management — we handle the entire process at no cost to you.