Fractional CISO services from a practitioner-led firm.
Fractional CISO and virtual CISO (vCISO) are the same engagement. Senior security leadership on a retainer, faster than hiring, cheaper than full-time, deeper than a compliance platform.
Same scope as a full-time Chief Information Security Officer: SOC 2, ISO 27001, HIPAA, PCI DSS, and CMMC readiness, vendor risk, board reporting, incident response leadership. Different contract: month-to-month, sized to the company that hires us.
- Starts in 2 to 4 weeks, not 4 to 6 months
- Month-to-month retainer, no annual contract
- Technical validation scoped to the roadmap
- Senior practitioner doing the day-to-day work on every engagement
Fractional CISO, virtual CISO, full-time CISO. Which one do you need?
The terms get conflated. The differences are real. Here is the side-by-side most buyers wish someone had written for them.
Fractional / Virtual CISO
Senior leadership, fractional time
- Cost
- $3K – $15K / mo
- Time to start
- 2 to 4 weeks to start
- Scope
- Strategy, compliance, policy, vendor risk, board reporting, IR. Same scope as full-time.
- Best for
- Most companies between 10 and 250 employees. The default answer for growth-stage teams with active customer-driven security demand.
Full-time CISO
Headcount and equity
- Cost
- $250K – $400K / yr loaded
- Time to start
- 3 to 6 months to recruit
- Scope
- Full operational ownership. Sits on exec staff. Headcount under them.
- Best for
- Companies above ~250 employees with material risk profile, multiple frameworks in production, and budget for a security org.
Compliance platform
Tool, not a leader
- Cost
- $300 – $2K / mo
- Time to start
- Same day, mostly self-serve
- Scope
- Evidence automation. Policy templates. Audit prep tooling. Does not write policies, lead IR, or take board calls.
- Best for
- Pair with a fractional CISO. The platform tracks evidence; the CISO does the work that produces the evidence.
What a fractional CISO actually does for your company.
The role is the same as any senior CISO. The contract and time commitment are different. Six work areas, owned end to end.
Strategic security roadmap
A 12-month roadmap ranked by ROI per dollar spent and tied to actual business drivers: audit dates, customer contracts, board asks, M&A diligence.
Compliance readiness
SOC 2 Type I and II, ISO 27001:2022, HIPAA, PCI DSS 4.0, CMMC Level 2, NIST CSF 2.0. Gap assessments tied to production evidence, not policy PDFs.
Policy authoring
Information security, access management, secure SDLC, incident response, vendor management, BCP and DR. Written to match how your team operates.
Vendor and third-party risk
Vendor inventory, tiering by data access, contractual review, ongoing monitoring. We handle inbound security questionnaires end to end.
Board and investor briefings
Quarterly board presentations and investor diligence support in language your CFO and CRO both understand. Decks are yours to reuse.
Incident response leadership
Pre-written runbooks, semi-annual tabletop exercises, on-call leadership. On day zero, you call us. You do not read someone else's runbook template.
What does a fractional CISO cost?
Industry-wide, fractional CISO services run $3,000 to $15,000 per month depending on engagement depth. Our published monthly rates are based on ownership:
Advisory vCISO
Monthly senior guidance for teams that execute internally. Roadmap, policy and control review, compliance direction, and executive recommendations.
Compare engagement levelsManaged vCISO
Monthly security reviews, policy authoring, customer questionnaire response, annual IR + DR tabletop.
Book a discovery callEmbedded vCISO
Hands-on leadership for audit prep, M&A, and complex programs. Weekly syncs, board briefings, on-call IR, compliance platform admin.
Book a discovery callThree levels. One month-to-month model.
Advisory vCISO starts at $3,000/mo, Managed vCISO starts at $5,000/mo, and Embedded vCISO is custom scoped and typically starts around $10,000/mo.
Not ready to talk? Score your SOC 2 readiness.
Twenty questions, a scored PDF in your inbox, a realistic timeline to audit. Free.
Common questions about fractional CISO services.
Is "fractional CISO" the same as "virtual CISO" (vCISO)?
In practice, yes. The two terms are used interchangeably across the industry. "Fractional CISO" emphasizes the time commitment (a fraction of a full-time role); "virtual CISO" emphasizes the delivery model (remote, on retainer). Both refer to the same engagement: a senior security leader who owns your security program on a recurring basis without being a full-time employee. We use both terms because buyers search for both. The work is identical.
How is fractional CISO different from a full-time CISO?
A full-time CISO is a 40+ hour per week employee with full headcount, equity, and benefits. Total cost runs $250,000 to $400,000 loaded for a senior hire and 3 to 6 months to recruit. A fractional CISO works on a retainer (typically 4 to 20 hours per week depending on tier), starts within 2 to 4 weeks, and is paid as a vendor invoice. For most companies between Series A and Series C, a fractional CISO is the right answer until headcount or risk profile justifies a full-time hire.
What does a fractional CISO actually do?
Same scope as any senior CISO: security strategy, compliance program ownership, policy authoring, vendor risk reviews, board reporting, and incident response leadership. The day-to-day shifts with the phase: early in an engagement, most hours go to gap analysis and policy work; mid-engagement shifts to vendor reviews and customer questionnaires; steady state is quarterly board cadence, audit liaison, and IR readiness. Retainer clients get weekly status notes so the work is visible.
How much does a fractional CISO cost?
Industry-wide, fractional CISO services run $3,000 to $15,000 per month. Our Advisory vCISO starts at $3,000 per month, Managed vCISO starts at $5,000 per month, and Embedded vCISO is custom scoped and typically starts around $10,000 per month.
When does a company need a fractional CISO?
Five common triggers: (1) a SOC 2, ISO 27001, HIPAA, or PCI audit is on the calendar, (2) an enterprise deal is blocked on a security questionnaire, (3) a board or investor asked for a documented security program, (4) a near-miss or incident exposed how thin the program really is, or (5) you are bridging the gap to a future full-time CISO hire. Underneath every trigger is the same problem: the company has outgrown ad-hoc security and needs a senior owner.
Can I cancel a fractional CISO retainer any time?
Yes. Every engagement is month-to-month with 30 days notice. No annual contracts, no minimums, and no auto-renewal traps.
How does fractional CISO compare to compliance platforms like Vanta or Drata?
Compliance platforms automate evidence collection. They do not write your policies, run your incident response, sign your management representation letter, take your board call, or close the gaps the platform surfaces. A fractional CISO and a compliance platform work together: the platform tracks the evidence, the CISO does the work that produces the evidence in the first place. Most of our retainer clients use Vanta, Drata, or Secureframe; we are the human program around the tool.
How fast can a fractional CISO start?
Most engagements start within 2 to 4 weeks of signing, compared with 3 to 6 months for a full-time CISO hire.
Do fractional CISO services include penetration testing?
We run penetration testing in-house and scope it to the application, environment, and assurance requirement. Technical validation can be included in Managed or Embedded engagements when it is part of the agreed roadmap.
Ready to talk to a fractional CISO?
Compare the three engagement levels, book a discovery call, or take the free 4-minute SOC 2 Readiness Scorecard if you want a snapshot before talking to anyone.