Security work divides into steady work and emergencies. The steady work is a compliance program, policies, vendor reviews and customer questionnaires, and it suits a fractional CISO at a few days a month. Emergencies, such as a breach or the sudden loss of a security leader at a larger company, need someone full-time. That is the interim’s job.
When an interim CISO fits
Interims fit when security needs daily leadership for a defined period. The common cases: a breach or ransomware incident, where the response, the forensic firm, legal counsel, insurers, regulators and customers all need coordinating for weeks; the departure of a CISO at a company with a security team that cannot run without a leader; a major audit or regulatory examination with a hard deadline and serious findings; or a merger that requires two security programs to be combined. Interim CISOs typically work three to six months and are priced around $18,000 to $35,000 a month.
In an incident, the first calls usually go to your cyber insurer’s breach hotline and to legal counsel. The insurer often assigns a breach coach and a forensic firm. An interim CISO works alongside them.
When a fractional CISO fits
A fractional fits a company that needs a security program but not a full-time security executive. That describes most companies under $100M in revenue without a dedicated security team. The work is a risk assessment, policies, a compliance framework such as SOC 2 or ISO 27001, an incident response plan, vendor risk and customer assurance. Engagements typically run 2 to 4 days a month for 6 to 12 months or longer, and retainers usually run $4,000 to $15,000 a month.
Comparing cost
Four months of an interim at $25,000 a month costs $100,000. A year of a fractional at $7,000 costs $84,000. A company that had a fractional CISO and a tested incident response plan before an incident usually spends less on the response, because decisions are already made.
The private equity case
PE buyers increasingly run cybersecurity diligence before an acquisition, and the findings often become a 100-day remediation plan. Smaller portfolio companies usually address it with a fractional CISO, sometimes one shared across the fund’s portfolio for consistent policies and reporting. A serious finding, such as evidence of an earlier breach or a lack of basic controls in a company handling sensitive data, may justify an interim for the first months.
The exit case
Buyers look for security liabilities in diligence: past incidents, open vulnerabilities, missing policies, the state of compliance reports and whether customer contracts promise security the company does not deliver. A current SOC 2 or ISO 27001 report and a clean history make diligence faster. A fractional CISO brought in 12 to 24 months before a sale has time to put those in place; a SOC 2 Type 2 alone takes six months to a year. An interim during the sale can answer questions but cannot produce an audit report on short notice.
Moving between the two
Many vCISO firms offer incident response support as part of the retainer or at a set rate. Check those terms before you need them, including response times and the hourly rate during an incident.