Services · vCISO
A security leader, on retainer. Not a freelancer, not a full-time hire.
Hiring a full-time CISO costs $200k-350k+ a year and takes months to find. A vCISO from VITI Security gives you the same strategic security leadership - board-ready risk reporting, security roadmaps, compliance ownership, vendor management - for a fraction of the cost. We embed with your team, run your security program, and stand behind the work when auditors and customers ask.
Engagement tiers
Three tiers, picked to match your stage.
All tiers run as a monthly retainer with a three-month minimum, then month-to-month. 30-day exit either side.
Strategic Advisor
4-8 hours / month
- Monthly security review with your leadership
- Risk register maintained and prioritized
- Quarterly board-ready security summary
- Policy review (existing or new)
- Escalation point for security incidents
- Right for: 20-50 person teams that have basic security in place
Engaged vCISO
15-25 hours / month
- Everything in Strategic Advisor, plus:
- Security roadmap with quarterly milestones
- Vendor security assessments (SaaS, infra)
- Compliance ownership (ISO 27001, SOC 2, HIPAA, PCI-DSS, GLBA - pick what applies)
- Incident response readiness drills
- Customer security questionnaire responses
- Architecture and cloud-config review
- Right for: 50-200 person companies preparing for audit, raising a round, or selling to enterprise
Full vCISO
40+ hours / month
- Everything in Engaged, plus:
- Acts as your CISO in customer and investor conversations
- Manages your security team and outside vendors
- Owns your compliance certification process end-to-end
- Available for breach response and crisis management
- Onsite as needed
- Right for: Funded startups or growth-stage companies where a full-time CISO is the next hire but not for 12 months
What a vCISO actually does
The job in plain terms.
The word CISO gets thrown around. Here is what one actually owns.
The risk register
A live list of every security risk to your business - ranked by impact and likelihood, with owners and target dates. Without this, security is reactive.
The security roadmap
What you will fix in Q1, Q2, Q3 - and the trade-offs that requires (budget, time, hires).
Policies that match how you work
Not 50-page documents nobody reads. Lean, enforceable, written for your team size.
Board + customer reporting
Translating "we patched 47 CVEs" into language your board and your enterprise customers care about.
Vendor + contract review
Catching the SLA gaps, data residency issues, and breach notification clauses BEFORE you sign.
Compliance ownership
ISO 27001, SOC 2, HIPAA, PCI-DSS, GLBA - picking the right framework and getting you through it.
Incident readiness
Tabletop exercises. A runbook for ransomware, data breach, account takeover. So the day it happens, your team does not panic-Google.
Why VITI for vCISO
Why our vCISO retainer beats hiring a single freelancer.
Fractional pricing
A full-time CISO is a six-figure salary plus benefits. Our Engaged vCISO is a fraction of that, with similar strategic value.
Recognized methodology
Our consultants follow the standards your regulators and auditors recognize for incident response and security audits, mapped to ISO 27001 and SOC 2.
Cross-framework experience
We have taken companies through ISO 27001, SOC 2 Type 2, HIPAA, and GDPR readiness. The frameworks overlap more than they differ.
Bench depth, not a freelancer
When your vCISO is on a flight, you reach a backup with the same context. Independent freelancers cannot promise that.
No tool kickbacks
Our vCISO recommends the tool that fits your stack, not the one that pays us a referral fee. We have no commercial partnership with any security vendor.
How a vCISO engagement starts
From scoping call to embedded leadership in 30 days.
30-minute scoping call
We understand your business, current security state, and immediate pressures (audit deadline, customer ask, near-miss incident).
Two-week assessment
Your assigned vCISO reviews your stack, policies, contracts, and team. You get a written risk register at the end - yours to keep even if you do not engage further.
Engagement begins
Tier chosen based on the assessment. Monthly retainer, three-month minimum, then month-to-month.
Continuous + reviewable
30-day exit either side. We would rather you find the right CISO than feel locked in.
vCISO FAQ
How is a vCISO different from a security consultant?
Do we really need this? We have an IT lead already.
How quickly can a vCISO be effective?
Can a vCISO help us pass our SOC 2 / ISO 27001 audit?
What if we get breached? Are you on call?
Where are your vCISOs based?
Get a security leader on your team.
30-minute scoping call. We assess whether a vCISO is the right move, recommend a tier, and quote a fixed monthly fee. No commitment to book the call.