Stanchion Security

About Stanchion Security

Stanchion Security helps organizations in regulated environments prove their security controls actually work. Most companies facing an audit don't have a controls problem. They have an evidence problem. Access reviews happen but produce no artifact. Service accounts accumulate without owners. Policies describe processes nobody follows. Compliance automation platforms are good at flagging what's missing and no help at all in fixing it — and that gap is where audits stall. We close it. Stanchion works alongside your team to design controls that fit how your organization actually operates, implement the identity infrastructure that enforces them, and produce documentation that stands up under examination. What we do Compliance readiness. SOC 2 and HIPAA program design, gap assessment, control mapping to NIST frameworks, and audit evidence development. Identity and access governance. SSO, MFA, lifecycle management, and access review programs. Entitlement cleanup and least-privilege design across cloud and on-premise environments. AI agent security. Agents authenticate, hold credentials, and invoke tools across systems, usually with far broader access than intended. We scope agent entitlements, design least-privilege tool access, and build the audit trail showing what an agent did and under whose authority. Risk and program advisory. Security program assessment, cloud migration risk management, and technical program leadership. Background Led by Tom Tolleson: fifteen-plus years in regulated environments, including data engineering leadership at Aetna (CVS Health), HIPAA and SOC 2 framework design at Benefits Data Trust, clinical data security and DoD STIG auditing at a Navy medical facility, and program management at Lockheed Martin and Northrop Grumman. Security+ certified. Incorporated in Puerto Rico. Operating from New York. tom@stanchionsecurity.com