About Xorabyte
A fractional CISO practice for startups, built by a practitioner who has owned the outcome before.
What Xorabyte is
Xorabyte is a fractional CISO practice for startups. When an enterprise customer demands SOC 2, a security questionnaire blocks a deal, or an investor starts asking diligence questions, we take you from that moment to audit-ready without a full-time hire. You get senior security leadership on a retainer sized to a startup, and a clear owner for the outcome, not another report.
We work inside the tools you already use, including compliance platforms such as Vanta and Drata if you have one. If you don't, we keep your controls, evidence, and audit progress tracked for you and walk you through status every month, instead of leaving it buried in spreadsheets and email threads. You are buying an outcome, not a tool you have to learn and staff.
Why fractional
A full-time CISO is a salary most startups cannot justify before their first audit. A pure compliance tool has the opposite problem: it tracks the work, but nobody senior owns it, and the questionnaires, auditor conversations, and judgment calls still land on a founder. Fractional security leadership is the middle path. Someone senior owns your security posture, faces your customers and auditors, and stays accountable, at a fraction of the cost of the hire.
Who does the work
Xorabyte is founder-led by Arif Mohamed. You work with him directly from the first scoping call, and the person who scopes your engagement is the person who runs it. No bench, no handoff.
Arif is a working security practitioner, not a career consultant: a senior security engineer with over six years across security and infrastructure. That runs from hands-on engineering at consumer-scale, high-traffic web platforms, the kind where mistakes are found by real attackers rather than audits, through to owning SOC 2 and ISO 27001 compliance end to end for a company, scoping through auditor sign-off, and answering the client-facing security questionnaires that decide enterprise deals. When a customer blocks your deal on a questionnaire, he has turned that same panic into a plan before.
The technical depth is offensive as well as defensive: penetration testing experience, deep fluency with the OWASP Top 10 and the MITRE ATT&CK framework, and a production web application taken to full OWASP Top 10 compliance. Earlier in his career, Arif worked at ISA Cybersecurity, one of Canada's largest security firms. When an auditor or an attacker goes looking for the gaps, he knows where they look first, because he has found them and fixed them.
How we work
- Founder-led. The person who scopes your engagement is the person who runs it.
- Outcome first. The deliverable is a passed audit or an unblocked deal, not a slide deck.
- Straight talk. If a gap is real, you hear it plainly, with the shortest honest path to fixing it.
- Capacity capped. A maximum of three retainer clients at a time, so each gets senior attention.
Where we are based
Based in the Greater Toronto Area, working remotely with startups across Canada and the US.