SecurityStudio

SecurityStudio, founded in 2017 by Evan Francen and headquartered in Minnetonka, Minnesota, builds a suite of SaaS risk-assessment tools aimed at making information security risk measurable and communicable for organizations that lack a dedicated security team. Its flagship product, S2Org, walks organizations through a structured, largely yes/no assessment covering governance, people, process, and technology, and outputs an S2Score — a 300-to-850 risk score modeled deliberately on consumer credit scores — along with a prioritized remediation action plan. Companion products S2Vendor and S2School extend the same scoring methodology to third-party/vendor risk and to K-12 and higher-education institutions respectively.

Beyond the assessment platform, SecurityStudio operates the CvCISO (Certified virtual Chief Information Security Officer) Academy, a training and certification program aimed at standardizing what a competent vCISO practice looks like — relevant given how many small and mid-sized organizations now rely on part-time or outsourced CISO talent rather than a full-time hire. The company positions itself around a mission-driven message (‘mission before money’) distinct from typical vendor marketing, reflecting founder Evan Francen’s parallel work at FRSecure and public writing on the security industry.

SecurityStudio’s core differentiation is the S2Score itself: a single, easily explained number intended to let a board or executive team understand security risk the way they already understand a credit score, and to track improvement over time using the same yes/no assessment cadence. Its primary competition comes from broader GRC and risk-quantification platforms as well as free or lower-cost self-assessment frameworks; SecurityStudio’s target market of underserved small and mid-sized organizations, K-12 districts, and MSP-delivered engagements is narrower than the enterprise GRC buyers many larger platforms chase.