The short version
- A vCISO is a senior security leader retained fractionally — strategy, governance, and board-level reporting.
- The model fits mid-market firms, growth-stage companies, and enterprises between CISO hires.
- Deliverables mirror a full-time CISO's: security program, risk register, board cadence, remediation roadmap.
The longer explanation
Where the model comes from
CISO demand has outrun CISO supply for most of a decade. Full-time CISO compensation at a major enterprise can run past $500K base plus equity; that is economically impossible for most mid-market firms. At the same time, customer contracts, cyber insurance underwriting, and regulatory obligations are increasingly asking mid-market firms who their CISO is. The vCISO model — senior security leadership on a fractional basis — resolves the mismatch.
What a vCISO engagement looks like
The strong engagements we run have the same shape:
- Discovery phase (2-4 weeks). Assess the current security program against a relevant framework (NIST CSF, CIS Controls, or the client's regulatory regime). Document the risk register. Identify the 5-10 items that actually move the needle.
- Program design. Put a written security program in place with the policies, procedures, and controls the organization needs. Align to regulatory obligations (HIPAA, PCI-DSS, SOC 2, state privacy laws).
- Board and leadership reporting. Standing reporting cadence — typically monthly or quarterly — that translates security posture into business language leadership can act on.
- Operational advisory. Incident response support, vendor risk review, strategic decisions (tool selection, architecture review), training and awareness oversight.
- Regulatory and audit support. Examiner readiness, audit coordination, evidence production, attestation reviews.
What a good vCISO looks like
The role demands both breadth (security program design across all domains) and depth (enough technical credibility to be taken seriously by the security engineering team). Senior vCISOs typically have 15+ years of security experience including at least one full-time CISO or senior security leadership role, plus regulated-industry exposure matching the client's regulatory regime.
Equally important: the vCISO has to be good in the room with a board. Technical depth without executive presence produces reports leadership does not read.
Comparison to full-time CISO
| Dimension | vCISO | Full-time CISO | |---|---|---| | Cost | ~$10K-$40K/month | $300K-$700K+/year total comp | | Commitment | Month-to-month or quarterly | Long-term employment | | Breadth | Multi-client experience, pattern recognition | Deep organizational knowledge | | Depth of availability | Scheduled, bounded | Always on | | Right fit | Mid-market, growth-stage, bridge | Large enterprise, regulated at scale |
The right path often evolves over time. Mid-market firms engage a vCISO, mature their program, and transition to a full-time CISO once the program's operational load exceeds what a fractional model can serve.
How Thoughtwave approaches this
Our vCISO practice serves mid-market and regulated growth-stage clients with board-level security leadership, program design, and regulatory posture work. Engagements are scoped per quarter with a defined deliverable set, and we integrate with the client's existing security engineering or SOC (including our managed SOC when that is part of the broader engagement).
For the broader context, see our Cybersecurity Solutions service.