Not a checklist, not a hand-off.
The program fits you, start to finish.
Trusted by Leading Companies Worldwide
Check Point
CyberArk
JFrog
Fireblocks
Elbit Systems
Amdocs
FIBI
Clal Insurance
Bank of Israel
Meitav Dash
AU10TIX
CHEQ
IronScales
BrightSource
ZIM
PwC
Ormat
Bank Leumi
Harel
OTORIO
Psagot Investment House
EMC Cyber Solution Group
Avid Technologies
PicUP
CyberProof
ImLive
Ministry of Foreign Affairs
Israel State Comptroller
Israel National Cyber Directorate
Post Luxembourg
Services
Every engagement ends with something you can act on: a decision, a control, or an assurance you can put in front of a board.
AI risk & governance
Benchmark your AI practices against the standards that are becoming mandatory: governance and lifecycle through to business value.
For organizations deploying AI in production who need governance that maps to NIST AI RMF and the EU AI Act: not a policy PDF nobody follows.
Read more →Defense supply chain
If your contracts touch Controlled Unclassified Information, compliance is now a condition of doing business.
For contractors carrying CUI who need NIST SP 800-171 and DFARS 7012 evidence a DoD assessor will actually accept.
Read more →Cloud security
Cloud environments that are secure and cost-efficient at the same time, because you cannot fix one by ignoring the other.
For teams that need infrastructure secured and the bill under control at once: not a security review that ignores cost, or a FinOps review that ignores risk.
Read more →More capabilities
Work rarely arrives in isolation. Whatever sits next to it is covered by the same team, under the same accountability, so you are not managing three vendors to close one gap.
Who we are
Most people who come looking for GRC help are really looking for the "C": compliance. They get a set of conclusions, and the advisor's job ends there. Nobody stays accountable for whether the technical work behind those conclusions actually holds up. That gap is why CST-360 exists. The number in our name is not decorative. We advise on the governance and the risk, and we close the technical level ourselves, end to end: one team, one accountability, the full 360 degrees around the compliance checkbox, not just the checkbox.
Team
No pyramid staffing. Practitioners across methodology, architecture and security engineering: whoever scopes your work is who does it.
Founder & CEO · Cyber Security Methodologist
President of ISACA Israel, cyber security methodology expert and cyber risk policy maker with more than 25 years' experience. Previously a senior member of the Israeli Defense Forces cyber-defense doctrine development teams, where his work shaped security processes across the IDF, government bodies and commercial entities. Works with Fortune 500 companies, global enterprises, SMBs and stealth-mode startups.
CTO · Head of Architecture & Engineering
Cyber security architect and cloud solution expert with more than 10 years across IT, networking and cyber security. Managed projects in the IDF Mamram unit for four years, including end-to-end data migration from on-premise servers to Azure. Today he leads CST-360's technology services team.
Insights
Agents act on your behalf. That changes the blast radius of a bad decision, and the controls you need around it.
Read article →Why AI adoption without governance produces the same failure pattern cloud adoption did a decade ago.
Read article →Moving to the cloud isn't a security upgrade by itself: the real risk lives in the gap between the architecture diagram and what's actually running.
Read article →Newsletter
One email when something genuinely changes in cyber and AI risk: a new regulation, a framework update, a failure worth learning from. Roughly monthly. Unsubscribe in one click.
Let's talk
Pick the conversation that fits. We will spend the time on your actual exposure, not on a slide deck.
Security incident? Mark it urgent when you book.
Let's review your security posture.
Let's see how to govern your security programme and strategy.
A short introductory call.
