Security leadership by the month, instead of by the salary.
The job is real.
The full time salary usually is not.
At your size the security leadership work is genuine and it is also intermittent. There are weeks where it is a standing agenda item and weeks where it is nothing. Hiring a full time executive for that pattern means paying for availability you do not use, and most owners look at the number once and quietly decide to carry the risk instead.
Carrying the risk works until somebody external asks you to demonstrate you are managing it. That request rarely arrives gently. It is a customer questionnaire with a deadline, an insurer at renewal, or an auditor with a scope already written. At that point the missing thing is not software. It is the person who was supposed to have decided what standard you work to.
Sharing the role solves the arithmetic without pretending the work is optional. You get the decisions, the documents and the continuity, at a fraction of a salary, from someone who is already inside your environment rather than being introduced to it during the emergency.
What we run for you
Everything below sits inside the monthly fee. Nothing here is an upsell, which is why the list is worth reading before you compare it against a quote from anyone else.
A risk register that names owners and dates, not categories
Framework selection so you work toward one standard rather than four
Policy set written to be operated, not filed
Security roadmap tied to the technology budget
Audit and questionnaire preparation before the deadline, not during
Incident response plan that has been walked through
Vendor and supply chain review
Reporting a board or an owner can act on
Straight answers
A Chief Information Security Officer is the person accountable for how an organisation manages security risk: which standard you work to, what gets fixed first, what the board is told, and what happens during an incident. A virtual CISO is that role bought by the month rather than by the salary. For a company of twenty to fifty people the work is real but it is not a full time job, and hiring for it at market rate is rarely justifiable. Sharing the role is the honest answer to that arithmetic.
Usually one of four things has happened. A large customer has sent a security questionnaire you cannot answer. An insurer has started asking for attestations at renewal. You are pursuing a certification such as SOC 2 and have discovered it is an operational programme rather than a document. Or you have had an incident and the board has asked who owns this. If none of those has happened yet, the honest answer is that you probably have time.
Documents and decisions, mostly, which sounds unsatisfying until the audit arrives. A risk register with named owners. A chosen framework, so effort compounds instead of scattering. Policies written to be followed rather than filed. An incident response plan someone has walked through before it was needed. And reporting that lets an owner decide where the next dollar of security budget goes, which is the part that is genuinely hard to buy any other way.
A consultant delivers an assessment and leaves. That is useful once, and the finding list usually ages badly because nobody owns the remediation. The vCISO model is continuous: the same person carries the risk register forward, watches whether the fixes actually happened, and is present the following quarter when the priorities have moved. The value is in the continuity rather than the initial assessment.
It is included, from Cybersecurity & Compliance at $72 per user per month upward. That surprises people, because security leadership is usually sold as a separate retainer. It sits inside the plan because compliance evidence is easier to produce when the person defining the standard and the team operating the controls are the same organisation.
No, and the distinction matters. IT keeps the systems running. A CISO decides what risk the business is willing to carry and proves it is being managed. Those are different jobs, and combining them puts the same person in charge of both doing the work and judging whether the work was sufficient. When a client already has an IT person we run co-managed. They keep supporting your people while we take cybersecurity and compliance, and our team covers nights, weekends and anything they cannot get to.
Book a 30 minute IT review
We look at what you are running, tell you the two things we would fix first, and you keep the notes whether or not you hire us.