A full-time CISO costs £150k+ per year. A vCISO delivers the same strategic security leadership at a fraction of the cost.
Security leadership is not optional for companies pursuing enterprise customers or compliance certification. But a full-time CISO is expensive, hard to hire, and often more than a growing company needs. The virtual CISO (vCISO) model has emerged as the right answer for most companies at Series A to Series C stage. Here is how to decide which model fits your situation.
A Chief Information Security Officer is responsible for the organisation's information security strategy, programme, and risk management. In practice, this means: developing and maintaining the security programme; managing compliance certifications; overseeing incident response; advising the board and executive team on security risk; and managing the security team.
For a company at Series A to Series C stage, the security programme is typically in its early stages. The compliance certifications are being pursued for the first time. The security team is small or non-existent. The board needs education on security risk, not sophisticated risk reporting.
This is the stage where a vCISO delivers the most value, providing the strategic leadership and compliance expertise the company needs, without the cost and overhead of a full-time hire.
A vCISO is an experienced security leader who works with your company on a part-time or fractional basis. They provide the same strategic security leadership as a full-time CISO, but at a fraction of the cost, typically £3,000 to £8,000 per month, compared to £150,000 to £250,000 per year for a full-time hire.
The vCISO model works best when the company needs strategic security leadership but does not yet have the volume of security work to justify a full-time hire. This is typically the case from Series A through to Series C, or until the company has 200 to 500 employees and a dedicated security team.
A good vCISO brings not just security expertise but compliance programme experience, they have been through SOC 2, ISO 27001, and GDPR certifications multiple times and know how to run them efficiently.
The right time to hire a full-time CISO is when the volume and complexity of security work exceeds what a vCISO can deliver on a part-time basis. This typically happens at 300 to 500 employees, when the company has multiple compliance certifications to maintain, a dedicated security team to manage, and board-level security reporting requirements.
The transition from vCISO to full-time CISO should be planned, not reactive. A good vCISO will help you define the role, write the job description, and support the hiring process, ensuring continuity of the security programme.
Some companies use a vCISO to bridge the gap between the departure of one full-time CISO and the hiring of the next. This is a common and effective use of the model.
Netru methodology