Security executives are among the most expensive and hardest to hire, and most companies under $100M in revenue do not have enough security leadership work to keep one busy. A fractional CISO fills the gap until the company has a security team that needs daily management, or a regulator or customer base that demands a full-time leader.
The full-time math
A CISO at a $50M to $200M company typically earns $220,000 to $350,000 in base salary, with a bonus and sometimes equity. Payroll taxes and benefits add 20% to 25%. A recruiter adds 25% to 30% of first-year cash. Year one all-in lands around $280,000 to $500,000. The candidate market is tight, and CISOs at smaller companies often leave for larger ones. A full-time CISO also needs a budget and at least one engineer or analyst to be effective, which adds another $120,000 to $200,000.
The fractional math
vCISO retainers typically run $4,000 to $15,000 a month, about $48,000 to $180,000 a year. Many firms include an analyst for evidence collection and documentation. Audit fees, compliance software and security tools cost the same in either model.
Where full-time starts to make sense
Headcount is the starting point, and regulated data pulls each band earlier.
- Under 50 employees, selling to mid-market or enterprise customers: fractional, with a managed IT provider handling operations.
- 50 to 250 employees, with SOC 2 or ISO 27001 in place: fractional at 2 to 4 days a month, often with an internal IT or security engineer who runs daily operations.
- 250 to 500 employees, or heavy regulation in health, financial services or defense: the switch usually happens here, especially when the company has two or more security staff to lead.
- Over 500 employees, a public company, or one where security is part of the product: full-time CISO with a team.
Contract terms can move the threshold. Some enterprise and government customers require a named security officer with specific responsibilities; check whether a fractional arrangement satisfies the clause.
What you lose with fractional
You lose a leader who is present when an incident starts. Most vCISO contracts include incident support, but a fractional with several clients may need hours to engage. You lose daily oversight of security operations, so problems in monitoring or patching surface later. You lose some cultural influence: security habits spread when a visible leader keeps raising them. And a fractional is less able to build a security team from scratch.
What you gain
You gain senior experience across many companies and frameworks. A vCISO who has taken a dozen companies through SOC 2 knows where audits fail and which controls auditors focus on. You pay for the hours the program needs. And you get compliance work done faster, because the playbook already exists.
A sensible sequence
Fractional CISO first, to build the program, pass the first audit and write the incident response plan. Hire an internal security engineer or IT manager to run daily operations under the fractional’s direction. Hire a full-time CISO when the security team reaches two or three people, when regulation requires it, or when the company’s largest customers expect a named security executive in the building.