CannaShield gives Connecticut cannabis dispensaries, cultivators, processors, and MSOs the vCISO services, GRC frameworks, and cybersecurity assessments to protect operations, strengthen insurance readiness, and produce defensible control evidence.
CANNABIS CYBERSECURITY FOCUS
CannaShield is a Connecticut-based cybersecurity and GRC partner for cannabis operators. We help translate cyber risk into license protection, insurance readiness, downtime prevention, and practical control evidence that executives, brokers, regulators, and investors can understand.
Dispensaries, cultivators, processors, manufacturers, MSOs, and ancillary cannabis operators.
Licenses, customer data, patient data, POS systems, email domains, vendor payments, recovery plans, and audit evidence.
Virtual CISO, GRC programs, cyber insurance readiness, incident response retainers, BEC defense, and ransomware resilience audits.
WHAT WE PROTECT
Your MSP handles IT. Nobody owns the written ISP, vendor risk, or audit-ready evidence your regulator wants at renewal.
We deliver NIST CSF 2.0-mapped security programs built for cannabis operators — designed to hold up when your regulator, investor, or acquirer asks for proof.
From $1,800/mo
Explore License Protection →Premiums went up 40%. Your carrier wants MFA attestation, an IR plan, and EDR proof — or they're non-renewing you.
We prepare the documentation, close the gaps, and sit on the call with your broker so you walk into underwriting with the evidence your carrier is asking for.
From $1,800/yr
Explore Insurance Qualification →POS goes down and you lose $30,000 a day. STIIIZY scared your board. Someone almost wired $200K to a fake vendor.
Incident response retainers, ransomware resilience audits, and BEC defense sprints — so when it hits the industry, it doesn't shut you down.
From $1,200/mo
Explore Downtime Prevention →THE THREAT IS REAL
These aren't hypotheticals. These are your peers.
January 2025
380,000 people notified
Root cause
Third-party POS vendor breach
Patient data, purchase history, ID scans — all exposed.
Disclosed November 2023
$646,000 wired to attackers
Root cause
Business Email Compromise (BEC)
A spoofed vendor email. One wire transfer. Gone.
Industry reference
Statewide seed-to-sale outage in Pennsylvania
Root cause
Software update failure at the tracking-system vendor — no attacker involved
Dispensaries turned away patients and closed early. Downtime doesn't require a breach.
2024
Breach disclosed to regulators
Root cause
Undisclosed network intrusion
Public company. Mandatory disclosure. Brand damage.
2024
Customer data leaked
Root cause
Third-party vendor compromise
Government-run. Still got hit.
Your MSP owns the systems. Someone still has to own the decisions.
START HERE — FREE
Enter your domain. Get a report on your DMARC, SPF, and DKIM configuration — and whether attackers can impersonate your brand in 60 seconds.
Free · 90 seconds · No account needed
Check your domain →See what Shodan, certificate logs, and breach databases already know about your business — open ports, exposed subdomains, breach history, and spoofing risk.
Free · 60 seconds · Passive recon only
Run the snapshot →A Connecticut-focused security-readiness check for cannabis operators. See where your controls need work before renewal, insurance underwriting, or counsel review.
Free · 60 seconds · No account needed
Check your compliance →WHAT WE DELIVER
LP-1
$1,800/mo
Ongoing
You need a real security program, not a policy folder.
LP-2
$2,500–$4,500
3 weeks
Renewal, expansion, or investor diligence is coming.
LP-3
$3,500
2 weeks
Schedule III change creates new control expectations.
IQ-1
$2,500
3 weeks
Your carrier is asking harder questions.
IQ-2
$1,800/yr
2 weeks pre-renewal
Renewal is close and the paperwork is stale.
DP-1
$1,200/mo + $275/hr
Ongoing
You want IR muscle before the weekend call.
DP-2
$3,000
2 weeks
Finance is one spoofed email from a bad wire.
DP-3
$4,000
3 weeks
Your POS, backups, and recovery plan need proof.
TOF-1
$750
1 week
You need a written snapshot of your exposure before committing to a program.
Founder
Alex Castrillo
Cyber incident response analyst · vCISO for Connecticut cannabis operators
WHY CANNASHIELD
Alex Castrillo runs incident response in-house for a national identity and security company in New York City. Since 2023 that's meant live alerts, real evidence questions, and the part nobody puts in a brochure: deciding what actually happened and who needs to be told.
CannaShield is that same discipline, sized for a licensed operator. A written security program. Evidence you can hand to a regulator, an underwriter, or an acquirer without a scramble. A decision path for the day the POS stops syncing and nobody's sure whether customer data moved.
He hasn't worked a cannabis breach from the inside, and he won't claim otherwise. What he's done is read the STIIIZY notices the way an analyst reads them — vendor-caused, 380,000 people, identity documents in scope — and build the controls and evidence that make that kind of failure survivable here.
WORK WITH US
You handle IT. We handle GRC. No competition, no overlap — just stickier clients and 10% of first-year recurring revenue on referred retainers, plus $500 per fixed-fee project.
Become a partner →Your insureds present stronger, clearer evidence for underwriting — we don't promise coverage or premium outcomes. CannaShield is listed as your preferred remediation vendor.
Become a partner →Pre-incident hygiene and technical incident-response preparation that outside counsel can structure under privilege.
Become a partner →WHO WE SERVE
RESOURCES
Practical cybersecurity briefings, grounded in primary sources and written for Connecticut cannabis businesses.
Start here / 2026 operator guide
The DCP reporting clocks, tracking-system controls, privacy rules, and evidence your team should have ready before an incident or inspection.
GRC & Frameworks
Twelve controls, ordered by what actually prevents loss, with the evidence each one should produce. Built for operators who have limited hours and need to spend them well.
Read →Compliance & Licensing
A method for reading any state’s obligations, plus what applies in Connecticut, New York, Massachusetts, New Jersey, and Illinois. Verify the details with counsel before you rely on them.
Read →Security Leadership
Most licensed operators do not need a full-time CISO. They do need someone accountable for security decisions. Here is how to tell which one you are.
Read →FAQ
CannaShield provides cannabis-specific cybersecurity, virtual CISO, GRC, cyber insurance readiness, incident response, ransomware resilience, and email security support.
CannaShield serves licensed Connecticut cannabis dispensaries, cultivators, processors, manufacturers, MSOs, and ancillary operators.
No. CannaShield works alongside MSPs by owning the cyber risk, compliance evidence, vendor risk, incident response, and board/regulator-facing security program work that many MSPs do not cover.
The Email Security Scorecard checks DMARC, SPF, DKIM, MX, and domain spoofing signals so cannabis operators can see whether attackers can impersonate their business domain.
Free. No account. Just your domain.
· NIST CSF 2.0 Mapped · No account required · Results in 90 seconds