vCISO vs full-time CISO: cost and fit

A vCISO, also called a fractional or virtual CISO, is a senior security leader who works part-time inside the business. A full-time CISO is a permanent executive hire. The choice is less about cost than about scope: if the work is a program to build and a set of meetings to run, a fractional CISO usually fits a mid-market company better; if the company runs its own security team across several sites, a full-time leader usually wins.

Here is how to tell which one you actually need.

What each option is

A fractional CISO holds a standing part of the week. The retainer buys judgment, ownership of the security program, and attendance at the meetings where security decisions get made. The consultant is not an employee, does not manage your staff on a daily basis, and is not on call around the clock.

A full-time CISO is an employee with a permanent calendar. That person runs the security function day to day, manages the analysts, sits in leadership meetings, and owns incident command. For a company with an internal security team, this is a real job that cannot be compressed into two days a week.

What a vCISO does week to week

A useful fractional arrangement is concrete, not advisory. In a typical month the retainer covers:

• A security program review with the IT leader, with named owners and due dates.
• Policy work: acceptable use, access control, incident response, vendor risk, backup and recovery.
• Audit and insurance evidence, collected once and mapped to the framework in play.
• Vendor and AI tool reviews, including data handling, access, and contract terms.
• Board or ownership reporting in plain language.
• Escalation on incidents and near misses, with a named decision path.

If a proposal describes none of that, it is advice, not leadership.

What a full-time CISO does that a vCISO does not

A full-time hire owns the function in real time. They manage staff, set the daily operating rhythm, handle a 2am escalation as part of the job, and carry the internal authority that comes with being an executive. If your company has a security team, a compliance obligation that requires daily oversight, or a board that expects a full-time officer, the fractional model will feel thin no matter how good the consultant is.

The cost comparison

A full-time CISO costs $180,000 to $280,000 in salary plus benefits, and the search takes three to six months. The first 90 days are ramp, which means the program does not really start until roughly six months after you decide to hire. The Fractional CISO retainer is $9,500 a month for two days a week on a 90-day initial term, and it starts within weeks.

That is not a like-for-like comparison, and it is not meant to be. You are buying a different amount of the job. The question is whether the amount you need justifies the permanent hire.

When a full-time hire is right

• You already have a security team that needs a manager.
• You are regulated in a way that requires daily oversight and named accountability.
• Security is a standing board topic with a budget line of its own.
• The work is large enough to fill a full calendar and will be for several years.

When a fractional CISO fits

• You have no security leader, and the immediate job is building the program.
• A customer questionnaire, a SOC 2 or ISO 27001 timeline, or an insurance renewal is setting the deadline.
• IT is led by a capable director who needs senior cover, not a second manager.
• AI tools are spreading through the business and nobody owns the policy.
• You may hire a full-time CISO later and want the program ready first.

How the transition works

The sensible path for a mid-market company is to start with the paid Security & AI Risk Diagnostic, then convert to the retainer. The diagnostic gives both sides evidence: what is missing, what it costs to fix, and how much leadership the program needs. If the answer is one day a week instead of two, that is a scoping decision made on evidence rather than on a sales call.

The retainer terms are short on purpose. A 90-day initial term means you re-decide with the first quarter of work in hand. If the company outgrows the arrangement, we say so and help write the job description for the full-time hire.

If you are deciding between the two, start with the Fractional CISO page or request a briefing and describe the trigger. We will tell you which shape of help fits before you commit to either.