Flagship service · Dallas–Fort Worth, Texas
Fractional CISO & Security Leadership
You need CISO-level judgment. You cannot justify a $180,000–$280,000 hire, plus benefits, plus a three to six month search. We embed a senior security leader two days a week for $9,500 a month, on a 90-day initial term, and the program is written to run without us.
What a fractional CISO actually does
A virtual CISO, also called a vCISO or fractional CISO, is a senior security leader who works with your company part-time. You get the judgment and the program ownership without adding an executive to payroll. Here is the work.
Owns the security program
One written program with named owners, dates, and metrics. Not a pile of projects that each die when the champion changes jobs.
Writes and maintains policy
Acceptable use, access control, incident response, vendor risk, backup, and AI use. Written for your business, in your templates, approved by your leadership.
Runs vendor and third-party risk
Reviews before the contract is signed, not after. A vendor register that says what each supplier can reach and what evidence you hold.
Prepares the audit or insurance renewal
Evidence collected once and mapped to the framework that matters this year: SOC 2, ISO 27001, NIST CSF, HIPAA, or PCI DSS.
Reports to the board or ownership
A one-page risk view in business language every quarter: top risks, decisions needed, and progress against the roadmap.
Sits in the room
Customer security calls, insurer questions, incident escalations, and the meetings where a security decision is actually made.
Who the retainer is for
The retainer fits a $20M–$500M company with 50–500 employees that needs security leadership now and cannot wait three to six months for a hire.
You are a fit if
- You have no full-time security leader, or the leader just left.
- A customer security questionnaire or SOC 2 request keeps repeating.
- Your cyber-insurance renewal asks for evidence of controls you cannot show.
- Staff use ChatGPT and other AI tools with no policy, no inventory, and no review.
- A customer, auditor, or investor has set a date and no one owns the response.
- An incident or near miss made the board ask what happens next time.
We are not the right call if
- You need 24/7 security monitoring. We do not operate a security operations center and we will refer you to a managed provider.
- You need someone to issue a certification or audit opinion. We prepare you; an independent assessor attests.
- You need an exploitation or red-team operator. That work is scoped and managed with vetted testing partners, and we do not perform it ourselves.
How the first 90 days run
Two days a week, scheduled in advance with your team. The 90-day initial term is long enough to produce a working program, not just a plan.
Diagnose
Baseline the controls, systems, vendors, and AI use that exist today. Most engagements start from the paid Security & AI Risk Diagnostic, so the first month builds on evidence the team has already seen.
Build
Write the policy set, close the access and vendor gaps that matter most, start the evidence register, and inventory AI use cases with an owner for each one.
Prove
Produce the first board report, organize the evidence for the next audit or renewal, and sign off a roadmap your team owns. Then decide: continue the retainer, move to a project, or hire full-time.
What the client keeps
You own everything we produce: the files, the wording, the evidence, and the method. There is no proprietary black box, and nothing is written to keep you dependent on the retainer.
- A policy set in your templates, approved by your leadership.
- An evidence register mapped to the framework you are being asked about.
- A prioritized roadmap with owners, effort, and dates.
- A vendor register that records what each supplier can reach.
- The board pack format, so the next report can be produced without us.
- A handover pack for the day you hire a full-time security leader.
Built to end well
A fractional leader who makes himself permanent is not doing the job. The program should be documented well enough that your IT director, CFO, and general counsel can run it, and specific enough that an auditor or a customer can test it.
At day 90 we review the program with you. Continue month to month, move to a defined project, or hire full-time with the handover pack already built.
Why it beats a full-time CISO hire
A full-time CISO costs $180,000–$280,000 in salary, plus benefits, plus a three to six month search, and the first 90 days are ramp. For a mid-market company, the same judgment can be delivered two days a week, starting in weeks.
| Alternative | What usually happens | What we do instead |
|---|---|---|
| Full-time CISO hire | $180,000–$280,000 in salary, plus benefits, plus a three to six month search. The first 90 days are ramp. | Same judgment, embedded in weeks, at a fraction of the annual cost. Two days a week, $9,500 a month, 90-day initial term. |
| Big-4 or large consulting firm | A partner sells the work, a team of juniors does it, and you get a readiness binder with a large invoice. | A senior practitioner does the work himself and leaves a program your team can run, not a document. |
| Managed security provider | Sells monitoring and tooling. The contract grows and the process gaps stay. | We fix the governance and the process first, then tell you which monitoring you actually need and refer you to a provider. |
| Freelance tester or one-off consultant | Cheap, but no program, no audit evidence, and gone after the report. | Diagnosis, policy, evidence, execution, and handover in one engagement. |
| Do nothing | The cost compounds quietly in unmanaged AI use, expiring insurance terms, and audit deadlines. | Start with the paid diagnostic and put a number on the exposure before you commit to a fix. |
The paid Security & AI Risk Diagnostic
Every retainer starts here, and every diagnostic ends with a decision. It runs 15 business days, includes two on-site or two full remote workshop days, and ends with a readout the board can act on.
After the readout: the Fractional CISO retainer at $9,500 a month for two days a week, a defined project, or no engagement if the findings do not justify the spend. The fee is credited against a follow-on engagement started within 45 days. Never a free audit.
Fractional CISO questions
What is a vCISO?
A vCISO, also called a virtual CISO or fractional CISO, is a senior security leader who works with your company part-time. You get the judgment, the policy ownership, and the board reporting without hiring a full-time executive.
How much does a fractional CISO cost?
The retainer is $9,500 a month for two days a week, on a 90-day initial term. A full-time CISO costs $180,000–$280,000 in salary, plus benefits, plus a three to six month search.
Do you sign our security attestation or audit report?
No. Attestations and audit reports come from an independent auditor or assessor. We build the control set and the evidence they will test, and we sit in the audit meetings with you.
What happens after the first 90 days?
We review the program at day 90. You can continue the retainer month to month, move to a defined project, or hire a full-time CISO and use the handover pack we built together.
Can a fractional CISO report to our board?
Yes. The retainer includes a written board report in business language: top risks, decisions needed, and progress against the roadmap. It is written for owners and directors, not for security engineers.
Start with the diagnostic.
The Security & AI Risk Diagnostic is the way in. 15 business days, a prioritized reading of your controls, and a decision about whether the retainer is the right next step.