Question 1

What is a virtual CISO (vCISO)?

Accepted Answer

A virtual CISO is a senior security leader engaged on a fractional basis instead of full-time. The role covers what a full-time Chief Information Security Officer would: security strategy, compliance program ownership, policy authoring, vendor risk, board reporting, and incident response leadership. The difference is the contract: a vCISO is a retainer or fractional engagement, typically month-to-month, sized to the company that hires them.

Question 2

How is a vCISO different from a full-time CISO?

Accepted Answer

A full-time CISO costs $250K to $400K loaded in base salary, equity, and benefits, takes 3 to 6 months to recruit, and is overqualified for most companies under 250 employees. A vCISO covers the same scope at a fraction of the cost, starts in 2 to 4 weeks, and scales up or down as the company grows.

Question 3

When should we hire a vCISO?

Accepted Answer

The clearest signals are external: your customers are sending security questionnaires, you have a SOC 2 or ISO 27001 audit on the calendar, your board has asked about your security posture, or you have lost a deal because a buyer wanted a security artifact you did not have. If any of those are true, a vCISO can typically pay for itself inside one or two enterprise deals.

Question 4

What does a vCISO do day to day?

Accepted Answer

Owns the security program at the strategic level: writes and maintains policies, runs vendor risk reviews, drafts customer security questionnaire responses, manages compliance audits and evidence collection, runs incident response when things break, and delivers board-grade briefings on cadence. Engineering still owns operational security; the vCISO owns the program around it.

Question 5

What does a vCISO not do?

Accepted Answer

We do not run a 24/7 security operations center. We do not staff a help desk or do tier-one alert triage. We do not provide MSP or MSSP services. If you need eyes-on-glass detection, hire an MDR provider (Arctic Wolf, Expel, ReliaQuest) and pair them with a vCISO for the program-level work. We have referred clients to MDRs many times.

Question 6

Is a vCISO the same as a fractional CISO?

Accepted Answer

Yes. The terms are used interchangeably across the industry. We use vCISO because the buyer search volume is higher, but the role, scope, and pricing are the same.

Question 7

What are the engagement options?

Accepted Answer

Three productized entry points plus a custom retainer. The 2-week SOC 2 Sprint at $2,500 flat is for teams with an audit on the calendar. The 90-Day vCISO Foundation at $24,000 builds a real working security program with a pentest in days 31 to 60. The Strategic vCISO retainer at $5,000 per month is the default ongoing engagement. The Embedded vCISO retainer is custom-scoped for higher-touch work and quoted on application.

Question 8

How do I know which engagement fits?

Accepted Answer

If you have a SOC 2 audit booked, start with the Sprint. If you need a real working security program but have no specific audit deadline, start with the 90-Day Foundation. If you already have a program in place and need ongoing senior leadership, start with the Strategic vCISO retainer. The discovery call is free and we will tell you which we think fits.

Question 9

Does the Sprint credit toward a retainer?

Accepted Answer

Yes. The $2,500 Sprint fee credits in full toward month one of a vCISO retainer if you sign within 30 days of Sprint completion. The Sprint becomes the discovery work for the retainer rather than a separate engagement.

Question 10

Does the 90-Day Foundation credit toward a retainer?

Accepted Answer

Yes. If you continue as a retainer client at day 90, the first month of retainer is credited in full. The Foundation acts as the discovery and baseline-building work that a separate retainer would have to redo.

Question 11

Can I switch engagement types mid-stream?

Accepted Answer

Yes. Most retainer clients start with a Sprint or Foundation, then convert. Inside a retainer, you can move between Strategic vCISO and Embedded vCISO scoping with 30 days notice.

Question 12

What is included in the Strategic vCISO retainer?

Accepted Answer

Monthly cadence with a senior practitioner who owns your security strategy, compliance program, customer questionnaire response, vendor risk reviews, annual IR and DR tabletop, and quarterly board briefings. 48-hour response SLA. Month-to-month, no annual contract.

Question 13

What is the difference between Strategic and Embedded vCISO?

Accepted Answer

Strategic vCISO is published at $5,000 per month and covers the program-level work for a single company. Embedded vCISO is custom-scoped and quoted on application. Embedded engagements are higher-touch: more hours per week, deeper integration with engineering, on-site time when relevant, and inclusion in the leadership team's cadence rather than just a monthly briefing.

Question 14

How is your pricing structured?

Accepted Answer

Three published prices and one inquire tier. SOC 2 Sprint: $2,500 flat fee for two weeks of work. 90-Day vCISO Foundation: $24,000 fixed-fee for a 90-day program. Strategic vCISO Retainer: $5,000 per month, month-to-month. Embedded vCISO Retainer: custom-scoped and quoted on application.

Question 15

Why is everything month-to-month?

Accepted Answer

If a vCISO retainer is not worth the price in any given month, you should not pay for it. We compete with consulting firms that lock buyers into 12 to 24-month contracts and then under-staff them. Month-to-month is the hardest thing for incumbents to match. Cancellation requires 30 days notice, no fees, no termination penalties.

Question 16

Can I cancel anytime?

Accepted Answer

Yes. Every engagement is month-to-month with 30 days notice. No annual lock-in, no termination fees, no autorenewing multi-year SOWs. The Founding Cohort 12-month discount is a price commitment from us, not a contract obligation from you.

Question 17

What is the Founding Cohort?

Accepted Answer

Five bounded retainer slots at 50% off list pricing for 12 months. Strategic vCISO drops from $5,000/mo to $2,500/mo. The SOC 2 Sprint drops to $500. The 90-Day Foundation drops to $12,000. In exchange we ask for testimonial, case study rights, and reference-call willingness. Year two reverts to then-current list pricing or you cancel.

Question 18

Do you do hourly billing?

Accepted Answer

No. We are not a $30 to $50 per hour shop and we do not bill hourly at the senior end either. Retainers are flat monthly fees with the scope written into the SOW. If your budget is hourly-contractor pricing, we can recommend a freelancer marketplace.

Question 19

Do you take equity in lieu of cash?

Accepted Answer

No. Cash retainers only. Equity is too easy to misprice on both sides and creates conflicts of interest at the security advisory level.

Question 20

Are there setup or onboarding fees?

Accepted Answer

No. The published prices are the total prices. Sprint kickoff, retainer onboarding, and Foundation kickoff are all included.

Question 21

What is a typical first-year cost?

Accepted Answer

Most clients spend $36,000 to $60,000 in year one on Strategic vCISO. Add a Sprint or Foundation for the entry point and that is roughly $36,500 to $84,000 total in year one. Compare to a full-time CISO at $375,000+ loaded.

Question 22

Which frameworks do you support?

Accepted Answer

SOC 2 (Type I and Type II), ISO 27001, HIPAA, HITRUST, PCI DSS, CMMC, NIST CSF, NIST SP 800-171, FedRAMP-adjacent work. The four most common engagements are SOC 2 (B2B SaaS), HIPAA + HITRUST (healthtech), PCI DSS (fintech), and CMMC (defense contractors).

Question 23

Do you perform the audit yourselves?

Accepted Answer

No. We are not a CPA firm. We do readiness, gap analysis, remediation, evidence collection, and audit support. Then a separate licensed audit firm performs the audit and issues the report. We help you select an auditor if you need a referral. This separation is required by every framework that produces an attestation.

Question 24

How long does SOC 2 readiness take?

Accepted Answer

Two weeks for a Sprint readiness assessment with deliverables. Eight to twelve weeks for full readiness with policy authoring, gap remediation, and evidence collection through the audit window. Six weeks is the floor for first-time SOC 2 if your team has done the technical work in advance.

Question 25

Can you handle multiple frameworks at once?

Accepted Answer

Yes. Most growth-stage clients run two or three frameworks in parallel (SOC 2 + ISO 27001, or SOC 2 + HIPAA, or SOC 2 + CMMC). The frameworks share 60 to 80 percent of underlying controls; we map controls once and produce evidence packages for each framework's audit window. Multi-framework is where embedded vCISOs add the most leverage.

Question 26

Do you work with Vanta, Drata, Secureframe, Oneleet, or ScalePad?

Accepted Answer

Yes, all of them. We administer compliance platforms inside retainer engagements. The platform automates evidence collection well; the human work is policy customization, vendor risk review, customer questionnaire response, and audit-prep narrative. We do the human work on top of whichever platform you have.

Question 27

Do you include penetration testing?

Accepted Answer

Yes. Every Sprint includes a light pentest. The 90-Day Foundation includes a full pentest in days 31 to 60. Standalone pentest engagements start at $4,500. We run pentests in-house, not subcontracted.

Question 28

Who actually does the work on my engagement?

Accepted Answer

Our founder personally leads every Sprint and every retainer. There is no partners-bait-and-switch pattern where the senior closes the deal and a junior runs the engagement. For specialized work (e.g. CMMC enclave architecture, deep AWS forensics), we engage vetted advisors from a bench of practitioners we have worked with before, with their participation called out in the SOW.

Question 29

Where are you based and do you work on-site?

Accepted Answer

Headquartered in Pittsburgh, PA. Pittsburgh-based clients get quarterly in-person executive briefings, on-site board meetings, and same-day incident response kickoffs at no extra cost. Non-Pittsburgh clients work with us remote-first with travel available on request.

Question 30

How do we communicate during a retainer?

Accepted Answer

Slack channel shared with your team for day-to-day. Monthly video review with engineering and security stakeholders. Quarterly board-grade briefing for leadership and investors. Weekly written updates for active workstreams. Whatever incident-channel pattern your team already uses for live response.

Question 31

What is your response time?

Accepted Answer

48-hour response SLA on Strategic vCISO retainer for non-urgent inbound. Same-day on Embedded vCISO. Same-day on any active security incident regardless of tier. Discovery call inquiries returned inside one business day.

Question 32

How big is the team?

Accepted Answer

Practitioner-led firm with the founder as principal consultant on every engagement. Specialized advisors brought in by the engagement when scope demands it. The firm is structured for senior-led delivery, not enterprise scale.

Question 33

What credentials do you hold?

Accepted Answer

CISSP, OSCP, AWS Security Specialty, CREST RPT. MS in Information Security from Carnegie Mellon. Active practitioner: pentests run in the same shop that delivers vCISO retainers, not subcontracted out.

Question 34

Do you sign NDAs?

Accepted Answer

Yes. NDA on first call as standard practice. Mutual or one-way, your standard or ours. We have signed hundreds of these and have no problem with reasonable terms.

Question 35

How is client data handled?

Accepted Answer

Client data is classified, encrypted at rest and in transit, scoped to least-privilege access by default. We use a separate access scope per client, no cross-client visibility. DPAs available on request and signed before any production data flows.

Question 36

Do you carry professional liability insurance?

Accepted Answer

Yes. Errors and omissions insurance sized for growth-stage engagements. Coverage certificates available on request during procurement review.

Question 37

How long do you retain inquiry and engagement data?

Accepted Answer

Inquiry emails retained for 3 years from last contact. Engagement-related communications retained per contract terms (typically 7 years after engagement close). Analytics data retained for 14 months. Full detail is on the privacy page.

Frequently asked questions.

General vCISO questions

Engagement types

Pricing and contracts

Frameworks and compliance

Working style and team

Data, privacy, and insurance

Still have questions?