Executive cybersecurity leadership, on the schedule you need.
Most mid-market companies need CISO-level judgment well before they need a full-time CISO. Our vCISOs run your program — board reporting, risk strategy, compliance ownership, hiring, vendor strategy — at 4 to 16 hours a week, with a senior bench behind them.
- Engagement
- Retainer
- Cadence
- 4–16 hrs / week
- Onboarding
- 2 weeks
- Min term
- 6 months
What a vCISO actually does for you
These are the recurring deliverables — every engagement is tuned to your stage, industry, and risk profile.
Security strategy & roadmap
A 12-month plan, refreshed quarterly. What changes, when, and at what cost — translated into business risk.
Board & executive reporting
Quarterly board materials and monthly executive readouts. Plain English, not heatmaps.
Risk register & policy ownership
We maintain the risk register, write the policies, and run the exception process.
Compliance program ownership
SOC 2, ISO 27001, HIPAA, CMMC — we own the program calendar, not just the audit week.
Vendor & tool strategy
What to buy, what to consolidate, what to drop. No reseller bias — we don't sell tools.
Security hiring & team design
Job specs, interview loops, comp benchmarks, and bench support while seats are open.
Incident readiness & response leadership
Tabletop exercises, IR plan ownership, and senior in-the-seat leadership when an incident hits.
Customer & deal-team support
Sales-cycle security calls, questionnaire response, and customer trust-center maintenance.
From kickoff to operating cadence
Five steps. Most clients are running on the operating cadence by week six.
- 01Week 1
30-minute fit call
We confirm scope, stage, industry, and the calendar of pressure points (audits, board cycles, fundraising, contracts).
- 02Weeks 1–2
Onboarding & risk register
Stakeholder interviews, stack review, and a starter risk register — calibrated to your actual revenue impact, not generic.
- 03Week 3
12-month roadmap
Quarter-by-quarter plan with budget envelope, dependency map, and a defendable narrative for the board.
- 04Ongoing
Operating cadence
Standing weekly leadership sync, monthly exec readout, quarterly board prep. Direct slack for between-meeting decisions.
- 05Quarterly
Review & re-plan
What changed, what got worse, what should we focus on next? Roadmap is re-prioritized, not re-written.
What you walk away with
- A 12-month security roadmap your board signs off on
- Risk register tied to revenue impact, not generic likelihood × impact
- Compliance program operating on a calendar — no fire drills
- Security questionnaire answer library for sales enablement
- Tabletop-tested incident response plan with named decision owners
- Defensible security narrative for customer trust calls
- Vendor stack consolidated where wasteful, hardened where deployed
- Hiring plan with comp benchmarks and a working interview loop
What makes our engagement different
Senior practitioners, not career consultants
Every vCISO has owned in-house security leadership at a mid-market or enterprise org. They've signed the audit attestation. They've made the 3am call.
Bench depth behind one named lead
Your vCISO is one person — but they're backed by our SOC, offensive team, advisory practice, and IR retainer. No 'I'll need to bring someone in next quarter'.
Independent of vendors
We don't resell tools. The advice you get is calibrated to your stack, not our margin.
Comp transparency
Day rate is published on the engagement letter. No mystery uplift, no hidden travel, no enterprise-edition tax.
Common questions
How is this different from a security consultancy?
A consultancy runs projects and leaves. A vCISO runs the program — they own the calendar, the board narrative, the policy library, and the next 12 months. Most clients use both: the vCISO owns the program, with project work routed through them.
When does it make sense to convert to a full-time CISO?
Usually when the program needs more than 16 hours a week of leadership attention, and when there's a defensible internal candidate to step up. Many of our vCISOs help recruit and onboard their full-time replacement.
Can the vCISO testify to the board?
Yes. We sign board materials, attend board meetings, and present quarterly. Many clients add their vCISO as an officer of the company for governance purposes.
What if we already have a security manager / director?
Even better. A vCISO works above that role — providing strategy, board interface, and senior judgment — while letting your in-house person own operations and people.
How do you handle conflicts when we disagree?
We document the recommendation, you make the call, and we don't sulk. If a pattern of conflict emerges, we end the engagement cleanly — no contract handcuffs.
Talk to a vCISO this week.
30-minute fit call with a senior practitioner — no slide deck, no sales floor. We'll tell you whether a vCISO is the right fit, and if it isn't, what is.