How much does a virtual CISO cost? Less than the question suggests, and also more than a single number can tell you. Most vCISO work is sold as a monthly retainer, and two companies of the same size can get very different quotes for good reasons. This guide explains how the pricing is built, what moves it, what you should receive for the fee, and how to spot a proposal that will disappoint you. Our own tiers, terms and pricing are on our vCISO services page.
How vCISO pricing usually works
A virtual CISO is a senior security leader who works for you part-time. The common ways to buy one are a monthly retainer for a defined level of involvement, a block of hours, or a fixed project such as getting ready for a first audit. Retainers are the most common because the job is continuous: risks, vendors, customer questionnaires and incidents do not arrive on a project schedule.
Retainers are usually sold in tiers. A light tier covers strategy, reporting and advice for a team that can do the work itself. A middle tier adds hands-on work such as writing policies or running vendor reviews. A full tier makes the vCISO the named security owner who runs the programme day to day. Our tiers follow that shape, with a three-month minimum and then month-to-month terms.
Hourly blocks suit a company that only needs occasional senior advice, but they make the vCISO reactive: nobody owns the programme between calls. Fixed projects suit a clear end point, such as a first audit, and should end with a handover so someone keeps the controls running afterwards.
Five things that move the price
Headcount is a weak predictor of vCISO cost. These five things matter far more:
- Which framework you are working towards, such as SOC 2, ISO 27001 or HIPAA, and how far you are from it today.
- Whether there is a deadline, such as an audit date or an enterprise customer waiting to sign.
- How much you want done for you rather than advised on.
- Your regulatory exposure: card data, health records or regulated financial data raise the bar for controls and evidence.
- How many vendors and systems are in scope. Vendor risk is the line most often underestimated in a first quote.
What a vCISO does in a normal month
Once the first quarter's foundations are in place, the work settles into a rhythm. A typical month includes some mix of the following, depending on the tier:
- Reviewing the risk register with the people who own each risk, and updating it.
- Answering customer security questionnaires and joining security calls during sales.
- Reviewing new vendors and renewing reviews of the riskiest existing ones.
- Keeping policies current as the business and its systems change.
- Checking that controls are actually running, such as access reviews, backups and patching.
- Preparing for, and acting as the main contact during, audits.
- A short written report for leadership on what changed and what needs a decision.
What you should get in the first 90 days
Whatever the tier, a good vCISO produces things you can hold and keep. By the end of the first quarter you should have:
- A named person, not a rotating bench, who answers when a customer or auditor asks who runs security.
- A current-state assessment against the framework or risks that matter to you.
- A risk register with owners and dates.
- A prioritised roadmap for the next two to four quarters, with a budget view.
- An incident response plan, tested with at least one tabletop exercise.
- A vendor review process and a first pass over your highest-risk suppliers.
- A regular leadership or board report that explains risk in plain language.
Red flags in a vCISO proposal
Most disappointing vCISO engagements were visible in the proposal. Watch for these:
- No named individual, or a promise that the senior person will join later.
- Open-ended hourly billing with no cap and no defined deliverables.
- An annual lock-in before you have seen any work.
- Mandatory tools resold with a margin on top.
- Documents that stay with the provider when you leave. The risk register, policies and roadmap should be yours.
- A promise of certification. Only an accredited body or an independent CPA firm can issue a certificate or SOC 2 report.
When a vCISO is not the right answer
A vCISO owns the programme, but does not usually operate your security tools around the clock. If you need alerts watched at night and on weekends, you need a monitoring service as well, such as a 24x7 SOC. If you need a single assessment and nothing afterwards, a fixed project is simpler. And if leadership cannot give the vCISO an hour or two a month for decisions, the retainer will produce documents that nobody acts on. Fix that first.
vCISO, full-time CISO or consultant?
A full-time CISO means a senior salary plus benefits, recruiter fees and months of searching, and it makes sense once the work genuinely fills a week, every week. A security consultant delivers a defined project and leaves, which suits a one-off assessment. A vCISO sits between them: continuous ownership of the programme without full-time headcount.
For most companies of roughly 20 to 200 people, the work is real but not yet full-time, which is why a retainer usually fits better. A good vCISO will also tell you when you have outgrown the arrangement and help you hire.
How to compare quotes fairly
Put each proposal side by side on the same questions: who exactly will do the work, what will be delivered each month and each quarter, what happens if you stop, who owns the documents, and what is excluded. A cheaper quote with no named person and no deliverables is not cheaper. Read our vCISO services page for our tiers, terms and pricing.
Frequently asked questions
Is a vCISO cheaper than hiring a full-time CISO?
How many hours a month does a vCISO work?
Can a vCISO get us SOC 2 or ISO 27001 certified?
What happens if we want to stop?
See our vCISO tiers and terms
Three tiers, a three-month minimum then month-to-month, and a fixed quote usually within one business day once we know your framework and deadline.