A hiring manager I spoke with recently runs the interview loop for fractional CIO and CISO roles. He stopped asking candidates whether they know what a control is. Everyone at that level knows. The question he asks instead: can you get our VP of Engineering to adopt this control without slowing down the product roadmap?
By his account, most applicants stall right there. Their resumes list ISO 27001, SOC 2 and NIST AI RMF. Far fewer can explain how a control actually lands inside a team that ships every week.
I think he is asking the right question, and AI is the reason it matters more now than it did two years ago.
Why startup compliance has felt heavy
The usual path to a first SOC 2 runs through a compliance platform. You connect your cloud accounts, pick a framework, and inherit a library of template policies tied to template controls. Those templates are written for a generic mid-size company. A twelve-person startup that adopts them as written commits to review boards and approval chains it will never actually run.
Custom policies were always an option on paper. In practice, founders don't have the hours to draft a dozen policies and then keep them current through every auditor conversation. That work usually waited until the company hired a full-time CISO.
So most teams accepted the templates, and the gap between what the policy said and what the team did became a standing risk. Auditors find that gap. Employees learn to ignore the documents.
What AI changes
A founder recently described his new workflow in a way that stuck with me. He points an AI model at the company's GitHub, calendars, Slack and codebase, and has it draft SOC 2 policies grounded in how the business actually operates. The change management policy describes the review process his engineers already follow. The access review policy matches the cadence the team already keeps.
The output is a policy set that is accurate to the business and sized for a small company. When the model recommends tightening something, he evaluates it on the merits and adopts the changes that make sense. His compliance program got lighter and stronger at the same time.
Where the platforms still earn their keep
Compliance platforms still matter, though less for their templates. Their lasting value is automated evidence collection: pulling access logs and configuration snapshots on a schedule so you aren't assembling screenshots the week before fieldwork.
The next step is easy to picture. An AI agent that gathers the day's audit evidence on request, maps it to the right controls, and flags what is missing. We are closer to that than most teams assume.
The part that still needs a person
Here is where the hiring manager's question comes back in. Writing the policy was never the hard part of the job. The hard part is the conversation with the VP of Engineering who has a launch in three weeks and sees your new control as friction.
As drafting gets cheaper, the value of a fractional CIO or CISO moves almost entirely into judgment: deciding which controls are worth the friction at this stage, and introducing them so engineering treats them as part of shipping well.
How we approach it at Aegis
We use AI to draft policies from how your team already works, then spend our time where it counts: sequencing controls against your roadmap and getting your engineering leads to own them before the auditor arrives.
Framework names on a resume are a signal. Translation is the skill.