Semper Sec
Procurement partnerAbout
Semper Sec is an enterprise GRC (Governance, Risk, and Compliance) program partner that unifies cybersecurity governance, privacy governance, AI governance, and third-party risk into a single operating program. The company provides assessment, implementation, managed operations, and advisory services delivered by senior US-based practitioners. Their model is designed to replace fragmented, project-based compliance work with a continuous, unified program capability that organizations can operate ...
Details
VenSearch Intelligence
Ideal Customer
- Semper Sec's historical sweet spot has been small-to-mid-sized businesses, explicitly calling out SMBs as their target across LinkedIn, Crunchbase, and PitchBook profiles.
- However, their current website positioning has shifted toward enterprise GRC, describing a strong fit when 'leadership is capable but stretched, ownership is unclear, or the program has to satisfy several frameworks at once,' and noting that enterprises working across security, privacy, legal, technology, and business functions get the most durable value from their Managed GRC offering.
Key Differentiators
- Semper Sec's core positioning differentiator is its 'programs, not projects' philosophy — operating GRC as a continuous capability rather than a periodic compliance sprint, so obligations are met between audits and not just before them.
- They emphasize a unified approach that maps security, privacy, and AI governance requirements under a single GRC program, which they claim competitors do not do, and they staff engagements with senior practitioners who have held CIO and CISO roles at large organizations, positioning their team as compliance mentors with real operational credibility.
Industries Served
- Semper Sec's documented client base includes Managed Security Service Providers (MSSPs), Software-as-a-Service (SaaS) providers, government contractors, and non-profit organizations, with specific case study evidence in cybersecurity software companies and sectors including IT, banking, and healthcare.
- Their Telarus supplier profile and LinkedIn specialties list coverage across virtually all industries in the GRC landscape, with specific framework competencies in healthcare and life sciences (HIPAA, HITRUST), defense industrial base (CMMC, CJIS), financial services (PCI DSS), aviation (FAA), and maritime (Coast Guard).
Service Coverage
- Semper Sec is a 100% U.S.-based firm headquartered at 1624 Market Street in Denver, Colorado, operating as a fully remote organization with no disclosed physical satellite offices.
- Their service delivery model is national in scope, serving clients across the United States, with no publicly documented international customer locations or offices.
Partnerships
- Semper Sec is a listed supplier on the Telarus master agent platform, a major technology services distributor, giving them channel exposure through Telarus's broad network of technology advisors and subagents.
- They hold a formal partnership with Hyperproof, a leading GRC platform, under which they operate as an MSSP partner and were named Hyperproof's MSSP of the Year in 2025, leveraging Hyperproof's platform to deliver continuous compliance programs for clients.
Company Size & Ownership
- Semper Sec was founded in 2017 by Rob Carson and Bradley Stine, and remains a very small firm with reported headcount of 8 employees according to PitchBook, and between 1–10 employees across multiple data sources including Crunchbase and ZoomInfo.
- Annual revenue is estimated at under $5 million per ZoomInfo, with projected annual IT spend of approximately $124,700 per Aberdeen data cited on Crunchbase.
Compliance & Certifications
- Semper Sec does not hold compliance certifications such as SOC 2 or ISO 27001 as a vendor itself; instead, they are a GRC advisory and managed services firm that helps clients achieve those certifications.
- The frameworks they support client-side span security (CMMC, ISO 27001, SOC 2, NIST CSF, PCI DSS, HITRUST, FedRAMP, FAA, Coast Guard, CJIS), privacy (HIPAA, GDPR, CCPA, ISO 27701), AI governance (ISO 42001, NIST AI RMF), and international standards (Cyber Essentials Plus, C5, EASA).
Compiled from public sources by VenSearch · Last researched October 14, 2026
Offerings
4 offeringsAdvisory
A service providing senior practitioner judgment for leadership decisions on regulatory and program strategy. It includes executive compliance leadership and vCISO and vDPO support.
Assess and Plan
A service for organizations that need a clear current state and a defensible plan. It includes risk, readiness, and maturity assessments, internal audit support, and a prioritized roadmap for the GRC program.
Build and Implement
A service for when strategy is set but execution has stalled. It covers governance and operating-model design, common control framework development, and the creation of policies, workflows, and adoption plans.
Managed GRC
An ongoing managed service that operates and matures the GRC program as a continuous capability rather than a periodic project. It includes continuous program management, third-party risk operations, and evidence and reporting operations so obligations remain met between audits, not just before them.
Considering Semper Sec?
Our team will work with you to determine if Semper Sec is the right fit for your organization. From research and assessment through procurement negotiation and ongoing vendor management — we handle the entire process at no cost to you.