1
TechCXO Editor's pick
6 named clients Founded 2003, 245+ people
Fee on request
Best fractional CISOs: firms and solo practitioners
A fractional CISO, often sold as a vCISO, owns information security for a company that cannot yet employ a full-time security executive. The common trigger is a customer: an enterprise buyer sends a security questionnaire or asks for a SOC 2 report, and the sale stalls until someone can answer. The work covers a risk assessment, policies, a gap review against SOC 2, ISO 27001, HIPAA or CMMC, an incident response plan that has been rehearsed, vendor risk and the evidence an auditor will ask for. Most engagements run 2 to 4 days a month for 6 to 12 months or more. vCISO firms rarely publish prices; retainers typically run $4,000 to $15,000 a month, with auditor fees and compliance software on top. Rows on this page show the regions and company sizes each provider serves; several pair a senior CISO with an analyst who does the evidence collection.
8 firms and practitioners on this page offer fractional CISO work. That is 7 firms and 1 marketplace. TechCXO is the editor's pick. One publishes a monthly fee: $2,280 a month at Leadership Services. The rest quote.
A fractional CISO, often called a vCISO, typically works 2 to 4 days a month, more during a compliance audit or after an incident. Engagements usually run 6 to 12 months or longer, because a SOC 2 Type 2 report needs an observation window of three months or more.
2
70+ peopleServes UK
$2,280 per month, no minimum
3
Serves UK
Fee on request monthly retainer
4
8 named clients Serves US
Fee on request monthly retainer
5
Serves Australia
Fee on request monthly retainer
6
7 named clients Founded 2017
Fee on request
7
5 named clients Serves US
Fee on request no minimum
8
Serves US
Fee on request
How this list is built. Every firm and practitioner here offers fractional CISO work on its own site. Order is editor's pick, then a published fee, then name. Nobody pays to appear or to move up. Full methodology.
CISO guides
- What is a fractional CISOA fractional CISO, or vCISO, owns security strategy, compliance frameworks such as SOC 2 and ISO 27001, and incident response for companies without a full-time CISO.
- How much a fractional CISO costsvCISO retainers typically run $4,000 to $15,000 a month, plus SOC 2 or ISO 27001 audit fees and compliance software. Drivers, project prices and how to read a quote.
- Fractional CISO vs interim CISOAn interim CISO leads security full-time after a breach or departure; a fractional CISO runs the security and compliance program part-time. Fit, cost, PE and exit cases.
- Fractional CISO vs full-time CISOA full-time CISO costs $280,000 to $500,000 in year one; a vCISO $48,000 to $180,000 a year. The threshold, the math and what a fractional security leader gives up.
- Fractional CISO vs consultantA security consultant delivers an assessment, a pen test or an audit report; a fractional CISO owns the security program and its compliance over time. Scope and sign-off.
- Fractional CISO vs coachingWhen a founder at $1M to $5M can handle security basics with training and a good IT provider, when to hire a fractional CISO, and when to combine them.
- How to become a fractional CISOThe path from security leader to fractional CISO or vCISO: frameworks to specialize in, packaging, pricing, liability and insurance, analyst support and a referral pipeline.
Questions founders ask
How much does a fractional CISO cost?
Most vCISO firms publish no prices; typical retainers run $4,000 to $15,000 a month, with audit and tooling costs on top. One listing on this page publishes a monthly fee: $2,280 a month at Leadership Services. The rest quote.
How many hours a week does a fractional CISO work?
A fractional CISO, often called a vCISO, typically works 2 to 4 days a month, more during a compliance audit or after an incident.
What is the difference between a fractional and an interim CISO?
An interim CISO works full time for a fixed period, usually while the company hires a permanent one. A fractional CISO works part of the week, often for two to four companies at once, and can stay for years.
How long do fractional CISO engagements last?
Engagements usually run 6 to 12 months or longer, because a SOC 2 Type 2 report needs an observation window of three months or more. 2 firms on this page publish their terms, and none asks for a minimum.
Do fractional CISOs take equity?
Some do, mostly with venture-backed startups. No firm on this page publishes an equity plus cash model, so ask on the first call.