vCISO vs CISO vs fractional CISO. Which one do you need?
Same role, four contract structures, very different cost and time-to-start. Pick the wrong model and you either underspend on a senior problem or overspend on a fractional one. Here is the side-by-side most buyers wish they had on day one.
Below: definitions, cost ranges, decision framework, and the company-stage signals that tell you when to graduate from one model to the next.
The 30-second answer.
vCISO / Fractional CISO
- Cost
- $3K – $15K / mo
- Time to start
- 2 to 4 weeks
- Contract
- Month-to-month
- Scope
- Senior security executive on a fractional retainer. Same scope as a full-time CISO at lower hours per week.
- Best for
- Growth-stage SaaS, healthtech, fintech, regulated SMB. Most teams under 250 employees with single or multi-framework programs.
Full-time CISO
- Cost
- $250K – $400K / yr
- Time to start
- 3 to 6 months
- Contract
- Employment
- Scope
- Permanent leadership with full operational ownership. Sits on exec staff. Hires headcount.
- Best for
- 250+ employees, material risk, multiple regulated frameworks active, security team of 3+.
Compliance platform
- Cost
- $300 – $2K / mo
- Time to start
- Same day
- Contract
- Subscription
- Scope
- Tool, not a person. Automates evidence collection and audit prep. Does not lead, does not sign letters.
- Best for
- Pair with a vCISO. The platform tracks evidence; the vCISO does the work that produces it.
Each model, defined.
Virtual CISO (vCISO)
A senior Chief Information Security Officer engaged on a fractional retainer instead of as a full-time employee. Owns the security strategy, compliance program, policy authoring, vendor risk, board reporting, and incident response leadership. Same role as any other CISO; different contract.
Fractional CISO
The same engagement as a vCISO, framed by time commitment. The terms are interchangeable in practice. We use vCISO because it is more searched and specific to security; fractional CFO and fractional COO use the same delivery model.
Full-time CISO
A permanent employee serving as Chief Information Security Officer with full headcount, equity, and benefits. Sits on the executive team, manages a security organization, and has full operational ownership.
CISO-as-a-Service
A productized version of vCISO with defined tiers, predictable pricing, and repeatable scope. Functionally identical to a vCISO retainer; the framing emphasizes productization (think SaaS pricing) rather than the role itself.
Interim CISO
A vCISO engagement specifically scoped to bridge the gap between a departing full-time CISO and the next one. Same retainer model; different engagement intent. Most interim CISO engagements end with the interim helping interview the permanent hire.
Which model fits which company.
Four signals matter: company stage, headcount, framework load, and whether you have an internal security team. Use the table to land on the right answer for your stage today, then revisit annually as you scale.
Compliance platform plus a SOC 2 Sprint when an enterprise deal lands.
At this stage the security ask is mostly customer questionnaires and the first round of audit prep. A compliance platform plus a one-time SOC 2 Sprint covers most teams. The Sprint is $2,500 fixed-fee with a pentest included, so the bar to engage is low. Ongoing retainer typically becomes worth it once enterprise demand picks up.
Strategic vCISO retainer ($5K/mo).
First enterprise deals appear, first SOC 2 audit on the calendar, board starts asking for a security update. A monthly Strategic vCISO retainer covers the program-level work; engineering still owns operational security.
Embedded vCISO retainer (custom-scoped). Add a security engineer in-house.
Multi-framework demand surfaces (SOC 2 Type II + ISO 27001 or HIPAA). Customer questionnaire volume becomes meaningful. Hire one in-house security engineer for operational work; vCISO owns program and strategy.
Either: scale to Embedded vCISO + 2-3 in-house engineers, or hire full-time CISO.
Decision point. If risk profile is contained and frameworks are stable, vCISO + small in-house team is more cost-effective. If risk is growing or you have multiple frameworks in active expansion, plan for a full-time CISO hire.
Full-time CISO. Use vCISO as interim during recruit.
At this scale, full-time leadership is almost always the right answer. Use a vCISO interim engagement to bridge the recruit and help interview finalists. Many of our retainer engagements end this way.
Not ready to talk? Score your SOC 2 readiness.
Twenty questions, a scored PDF in your inbox, a realistic timeline to audit. Free.
Common questions about CISO models.
Are vCISO and fractional CISO the same thing?
In practice, yes. Both terms describe a senior security executive engaged on a recurring fractional retainer rather than as a full-time employee. "Virtual CISO" emphasizes the delivery model (remote, on demand). "Fractional CISO" emphasizes the time commitment (a fraction of a full-time role). The work is identical. The terms have converged in usage over the past decade.
Is "CISO-as-a-Service" different from vCISO?
Same engagement, different framing. "CISO-as-a-Service" emphasizes productization (defined tiers, predictable pricing, repeatable scope), borrowing from SaaS pricing language. vCISO is the older term and emphasizes the role itself. Some firms use one or the other based on which buyer persona they target, but the underlying work is the same.
When should a company hire a full-time CISO instead of a vCISO?
Four signals: (1) You have crossed roughly 250 employees and have material risk profile, (2) you operate multiple regulated frameworks simultaneously and need full-time attention to all of them, (3) you have a security team of 3+ that needs a leader, or (4) your investors or board specifically want a full-time security executive on staff. Most companies that hit one of these signals start with a vCISO, then transition to a full-time CISO with the vCISO helping interview the eventual hire.
What is an interim CISO and how is it different?
An interim CISO is a vCISO engaged specifically to bridge the gap to a future full-time CISO hire. The contract framing is the same as a vCISO retainer; the engagement intent is different. We have run interim CISO engagements that ended with us writing the JD, sitting in on finalist interviews, and handing off to the full-time hire on day one.
Can a vCISO sign my management representation letter for SOC 2?
Yes. A vCISO is the named security owner of record during their engagement and signs the management representation letter when serving as the company's CISO. This is a key reason companies hire a vCISO instead of an unnamed consultancy: auditors require a single accountable security executive, and a vCISO is that executive on retainer.
How do I decide which model is right for my company?
Use the decision framework below: company stage, frameworks in scope, headcount, and security team size. Most companies between Series A and Series C should pick a vCISO. Most companies above 250 employees with multiple frameworks active should be planning toward a full-time CISO hire (potentially with a vCISO bridging the gap).
How does engagement structure differ between vCISO and consultancy?
A vCISO retainer is named-principal, recurring, and outcome-owned. The same senior practitioner shows up every week and signs your audit letters. A traditional consultancy engagement is project-scoped, often staffed with associates under a partner's brand, and ends when the deliverable is delivered. The vCISO model carries the program; the consultancy model delivers a project.
What about virtual CISO vs in-house CISO from a Big 4 firm?
Big 4 firms (Deloitte, KPMG, EY, PwC) offer vCISO services, but they typically use partner-rate billing with associate-staffed delivery. You pay $20K to $40K per month and the named partner shows up at kickoff and quarterly. Day-to-day work is run by associates. Practitioner-led firms (us, similar boutiques) charge $5K to $15K per month and the senior practitioner is the one doing the work. Pick Big 4 if you need the brand for procurement; pick boutique if you need the work done well.