Security is a field full of specialists: penetration testers, auditors, compliance consultants, managed security providers, forensic firms and software vendors. Each does one job well. A fractional CISO owns the program that ties those jobs together and answers for whether the company is secure enough for its customers and regulators.
What security consultants deliver
Security consultants take a defined piece of work. A penetration test checks systems for vulnerabilities and delivers a report. A risk or gap assessment compares your controls with a framework and lists what is missing. A compliance consultant writes policies or prepares evidence for an audit. A forensic firm investigates an incident. Each is priced by project, and each ends with a report.
Auditors are a special case. The CPA firm that issues a SOC 2 report, or the certification body for ISO 27001, must be independent. It tests your controls but cannot design them for you.
What a fractional CISO owns
A fractional CISO owns the security program over time. They choose the framework, set policies, decide which risks to fix first, select tools and vendors, commission penetration tests, prepare for and manage the audit, maintain the incident response plan, review vendors and answer customer security questionnaires. Retainers typically run $4,000 to $15,000 a month for 2 to 4 days.
Who signs off on decisions
With consultants, someone in the company has to decide what to do with each report. At many growing companies that someone is a CTO or an IT manager who already has a full job, and the findings wait. A fractional CISO takes the reports and decides: which findings to fix, in what order, with what budget, and which risks to accept and document. Risk acceptance is a real decision with legal and contractual weight, and it should be written down with the CEO’s sign-off. Agree in advance which decisions the fractional CISO makes, which need the CEO and how risk acceptance is recorded.
When a consultant is enough
If you have an internal security lead who needs specialist help, hire consultants. A penetration test, a one-time gap assessment, a policy set for a specific framework or forensic support after an incident are all good uses. If a customer asks for a single pen test report and nothing else, a testing firm will do.
When you need a fractional CISO
You need one when nobody inside the company owns security. The signs: pen test findings from last year are still open; customer questionnaires take weeks and the answers vary; you are preparing for SOC 2 and nobody has done one before; your cyber insurer’s questions went unanswered; or each consultant’s report sits in a folder.
The vendor question
Many vCISO services are offered by managed security providers or compliance software companies. That can work well, since the CISO knows the tools. But a CISO paid by a vendor may favor that vendor’s products. Ask whether the vCISO firm resells tools or software, and whether it will recommend a competitor’s product when it fits better.
Working together
A good fractional CISO manages the specialists. They scope the pen test, choose the auditor, brief the compliance software rollout and coordinate the forensic firm if something goes wrong.