vCIO4SMB: Design, Implementation, and Pilot Deployment of an Agentic AI Cybersecurity Governance Platform for U.S. Small and Mid-Sized Businesses

Paste the abstract from your paper: Small and medium-sized businesses (SMBs) — 33.2 million firms representing 99.9% of all U.S. businesses and 43.5% of national GDP — operate almost entirely without continuous, enterprise-grade cybersecurity governance, despite being targeted in 94% of cyberattacks annually. The structural root cause is economic: full-time Chief Information Security Officers (CISOs) cost $245,000–$428,000 per year, well beyond the reach of most SMBs. This paper documents the architecture design, pilot deployment, and iterative refinement of vCIO4SMB, an Agentic AI-powered cybersecurity governance platform built around two autonomous agents — the vCIO (Virtual Chief Information Officer) and the vCISO (Virtual Chief Information Security Officer) — that together implement all six functions of the NIST Cybersecurity Framework (CSF) 2.0 continuously and without requiring dedicated security staff. A pilot engagement was conducted with a 12-employee professional services firm in the Orlando, Florida metropolitan area. The pilot identified four critical governance vulnerabilities with no prior client awareness. Two priority recommendations were adopted within 30 days. The client committed to a quarterly retainer engagement, providing initial commercial validation at the $5,000–$12,000 annual price point. The vCIO4SMB platform demonstrates the technical and commercial feasibility of delivering autonomous, enterprise-grade cybersecurity governance to SMBs at a fraction of the cost of human-staffed alternatives, directly advancing the U.S. National Cybersecurity Strategy (2023) and Executive Order 14179 (2025) goals.