What does vCISO pricing actually buy?

A small company should buy vCISO work by the decisions it needs made, not by a bundle of policy templates. The price changes when the vCISO moves from occasional advice to owning a security program, attending executive meetings, answering customers, and directing technical remediation.

That distinction explains why two proposals called "vCISO" can differ by $10,000 a month. One buys a few hours and a document queue. The other buys an accountable security leader who knows the business, can challenge the CTO, and stays available when an enterprise customer or incident changes the week. Cheap work is not automatically bad, but cheap leadership is usually mislabeled advisory.

The useful market bands for a small US company are about $1,000-$3,000 a month for limited advisory, $3,000-$7,500 for a working program, and $7,500-$15,000 or more for embedded leadership. These are planning bands, not a price index, and the scope matters more than the number. A regulated health business with 35 employees may need more leadership than a 150-person marketing agency.

vCISO pricing pays for authority and access

vCISO pricing reflects how much context the adviser must absorb, how often the company needs decisions, and whether the person can direct work. Hours matter, but authority and response expectations drive the real cost.

A vCISO is a fractional executive, not an outsourced security operations center. The role sets priorities, translates business risk for leadership, assigns owners, accepts or escalates residual risk, and checks that the program actually changes. A managed security provider may run endpoint protection and monitoring. A compliance consultant may prepare evidence for an audit. Those jobs can support a vCISO, but neither automatically supplies executive ownership.

NIST Cybersecurity Framework 2.0 makes this separation unusually clear. It added Govern alongside Identify, Protect, Detect, Respond, and Recover. NIST describes Govern as establishing, communicating, and monitoring the organization's risk strategy, expectations, and policy. I would use that definition as a buying test: if a provider only scans controls or writes policies, it covers pieces of Identify and Protect but does not yet provide the Govern function you are paying a CISO to own.

Four variables move a quote faster than employee count:

• Regulatory and contractual exposure, including how many frameworks or customer security clauses apply
• The number of products, cloud environments, offices, and material vendors in scope
• The current team's ability to execute remediation without outside engineering help
• The promised cadence for meetings, questionnaires, incidents, board work, and audit support

Ask every bidder to separate leadership hours from analyst, compliance, penetration testing, and tool fees. A blended package can be sensible. An opaque package prevents you from seeing whether a senior person spends time on your company or merely approves work prepared by someone junior.

Pricing by employee count alone is lazy. Ten developers can maintain a payment product with production credentials, regulated data, and demanding bank partners. A 200-person local services company may use standard business software and hold little sensitive data. The first company can create more security leadership work even though it has a fraction of the staff. A sensible quote uses headcount as one input, then examines data, architecture, obligations, change rate, and the cost of a bad decision.

Geography also changes scope. A company selling across borders may need counsel to interpret privacy and breach duties, but a vCISO should know when to bring that counsel in and convert advice into operating requirements. Do not pay an executive security rate for legal guessing. Do pay for someone who can identify the question early, frame it clearly, and make sure the answer changes the roadmap.

The $1,000-$3,000 tier buys bounded advice

At roughly $1,000-$3,000 per month, expect a narrow advisory relationship with limited meetings and a small deliverable queue. This tier fits a small company that already has a capable technical owner and needs experienced review, not someone to operate the program.

A credible entry retainer may include a monthly leadership call, review of the risk register, a basic roadmap, limited policy review, and email questions within a stated response window. Some providers add a quarterly executive report or a fixed number of customer questionnaires. The vCISO should still learn enough about revenue, data, architecture, and contracts to rank risks in business terms.

What should not be assumed at this price: continuous control monitoring, hands-on cloud changes, 24-hour incident response, unlimited questionnaires, audit project management, or attendance at every sales call. A senior adviser cannot provide unlimited access for a four-figure annualized time budget. If the proposal suggests otherwise, either the senior person's time is extremely small or the delivery comes from a shared production team.

The tier works best when the CTO or IT lead can turn decisions into tickets and close them. For example, the vCISO may decide that administrator accounts need phishing-resistant authentication, define the deadline, and review evidence. The internal team still selects the supported method, configures it, handles exceptions, and troubleshoots deployment.

Demand a visible monthly output even when few documents change. A short decision log is enough:

• Require stronger authentication for administrators. The head of IT owns a May 15 deadline, an identity provider export proves completion, and two legacy accounts carry a temporary exception.
• Test the database restore. The platform lead owns a May 30 deadline, the test record captures evidence and timing, and recovery remains unproven until the test passes.

Without that trail, a monthly call becomes expensive conversation. The entry tier should leave management with decisions and named owners, even when execution sits elsewhere.

An entry retainer can also act as a control against founder optimism. Small teams often mark work complete because a setting changed, while nobody tests enrollment, recovery, or exceptions. The adviser should sample evidence and challenge completion claims. It cannot test everything within a small allowance, so the contract should state which controls receive review each month and how the company chooses them.

Expect the first month to cost the provider more time than later months. Discovery, access, and document review front-load the effort. Some firms charge an onboarding fee; others require a minimum term to recover it. Either model can be fair if the proposal shows what onboarding produces and avoids charging for the same baseline again under a separate assessment.

The $3,000-$7,500 tier should run a program

At roughly $3,000-$7,500 per month, the vCISO should maintain the security management system, lead a regular operating cadence, and keep work moving across teams. This is the practical range for many small B2B companies facing enterprise sales reviews, a first formal audit, or rising insurance demands.

Expect a current risk register, an approved roadmap, policies matched to actual practice, control ownership, recurring leadership meetings, metrics, and coordination with IT and engineering. The provider may manage a SOC 2 or ISO 27001 readiness plan, but clarify whether auditor selection, evidence collection, and remediation execution sit inside the fee. "Audit support" can mean one call with the auditor or months of project management.

The cadence often includes a biweekly working meeting and a monthly executive review. Quarterly board material may fit when the company already has a board reporting rhythm. The vCISO should join selected customer or insurer calls where security judgment affects revenue or coverage, not every routine questionnaire.

This tier also needs a functioning incident role. That does not mean the vCISO provides a forensic team. It means the contract names who can declare an incident, how to reach the vCISO, what response time applies, who advises the CEO, and who coordinates counsel, insurance, technical responders, and communications. An incident plan without those names and channels will fail at the first stressful hour.

I expect a monthly operating packet with at least these elements:

• Top risks, changes since last review, and decisions required from management
• Roadmap items completed, late, blocked, or accepted as risk
• Control exceptions with owners and expiration dates
• Customer, audit, vendor, and incident work consuming capacity
• Next month's commitments and any scope tradeoffs

The packet should be short enough that a founder reads it. Forty pages of green status boxes hide more than they reveal. The vCISO earns this retainer by forcing decisions, following through, and connecting security work to contracts, uptime, legal duties, and cash.

Ask who maintains evidence between meetings. If the vCISO updates the risk register while internal owners update tickets and evidence, name that boundary. If an analyst working for the provider collects evidence, identify the systems the analyst can access and the review performed by the senior lead. Many disappointing retainers fail here: the executive advises, the analyst requests documents, and nobody has authority to make an overdue owner act.

The program tier should budget capacity, not promise an infinite menu. A month consumed by an urgent customer review will displace a policy update or tabletop exercise. The vCISO should show that tradeoff and ask management to choose. Quietly carrying work forward makes the roadmap look stable while deadlines become fiction.

The $7,500-$15,000 tier buys embedded leadership

At roughly $7,500-$15,000 or more per month, expect an embedded fractional leader who works inside the management system and carries a meaningful share of executive accountability. Publicly listed retainers vary, and vCISO.com publishes a $5,000-$12,000 monthly range. Treat any market figure as a reference point, because availability and scope can make two retainers at the same price completely different.

This band fits a company with several products or environments, demanding enterprise buyers, multiple compliance obligations, an active acquisition process, or no internal security manager. The vCISO may attend weekly leadership meetings, own the security budget and roadmap, brief the board, lead audit readiness, review major architecture decisions, and manage security staff or vendors.

Access should improve materially. You may receive a defined urgent channel, same-business-day consultation for material events, and reserved capacity for executive or customer meetings. Put those terms in writing. "Priority access" has no operational meaning unless the agreement states response windows, covered hours, backup coverage, and what counts as an emergency.

Even an embedded vCISO does not replace every security discipline. One person cannot simultaneously act as executive, cloud engineer, privacy counsel, penetration tester, forensic responder, and round-the-clock analyst. A good leader identifies those needs and manages the specialists. A bad proposal quietly bills the executive rate while delegating all contact and output.

At this tier, require a named primary vCISO and approve substitutions. Ask how many clients that person carries and how reserved days work. The provider does not need to reveal every commercial detail, but it should explain capacity well enough for you to judge whether promised access is plausible.

Clarify decision rights before the first disagreement. The vCISO can recommend rejecting a risk, but the CEO or another named executive usually accepts major business risk. Engineering owns technical design unless management delegates that authority. Legal counsel interprets law. The vCISO connects those decisions and records them. Calling everyone "responsible for security" produces gaps because no one knows who can decide.

Board access changes the work as well. A board briefing requires preparation with the CEO, defensible source data, and a clear request or risk statement. It should not be a recycled operations report. If quarterly board attendance is included, state whether preparation and follow-up count against the monthly allowance and whether special meetings cost extra.

The upper range can approach a part-time hire. Compare it with the outcome you need, not merely with salary. A retainer brings fast access to established methods and may include supporting specialists. A hire builds internal context and offers daily availability. Once the role demands three or more fixed days each week for a sustained period, test whether a full-time security leader or manager now makes more sense.

Projects and hourly work solve different problems

Fixed projects and hourly consulting are appropriate for bounded questions, but they should not masquerade as an ongoing vCISO relationship. Use them for diagnosis, a transaction, or a defined build; use a retainer when decisions and follow-through recur.

A one-time assessment can establish the current state, rank risks, and create a 90-day plan. It is a good first purchase when management does not yet know whether it needs ongoing leadership. Define systems, interviews, frameworks, deliverables, and the readout audience. A cheap automated scan with a logo on the cover is not an executive assessment.

Project pricing also fits a policy set, tabletop exercise, vendor review, acquisition diligence, or audit readiness sprint. Each project needs acceptance criteria. "Prepare for SOC 2" is open ended; "map the stated scope to Trust Services Criteria, record gaps, assign owners, and deliver an evidence plan" can be accepted or rejected.

Hourly work suits unpredictable advice, contract review, or a second opinion. It creates a poor incentive for program ownership because the buyer starts rationing calls and the adviser has no reserved capacity. If you use hourly support, agree on a rate, minimum increment, monthly cap, response time, and advance approval threshold.

The most useful hybrid starts with a fixed assessment, then converts the agreed roadmap into a retainer. Credit for the assessment is optional, but the provider should not repeat discovery and charge twice. The retainer scope should change after the baseline because a company closing a first audit needs different work from one maintaining it.

Avoid percentage-of-budget pricing. Security leadership should challenge spending and remove weak controls. Paying the adviser more because the tool budget grows creates the wrong incentive. Company size, risk, complexity, and reserved capacity give both parties a cleaner basis.

A deliverable list needs acceptance tests

Every vCISO proposal should turn broad nouns such as "strategy" and "governance" into artifacts, decision rights, cadence, and completion rules. Otherwise the provider can deliver a template while the buyer expected an operating program.

This compact scope fragment forces a useful conversation:

service:
  primary_vciso: named_before_signature
  executive_review: monthly
  working_session: biweekly
  urgent_response: 4_business_hours
deliverables:
  risk_register: maintained_monthly
  roadmap: owner_due_date_status_for_each_item
  board_brief: quarterly
  incident_tabletop: annual
limits:
  questionnaires: 4_per_month
  policy_rewrites: 2_per_quarter
excluded:
  - legal_advice
  - forensic_investigation
  - remediation_engineering

Do not copy those numbers blindly. Copy the structure. For every line, ask who creates the work, who approves it, how often it changes, and what happens when demand exceeds the limit.

Add a responsibility schedule for recurring work. Security questionnaires, access reviews, vendor assessments, vulnerability triage, policy exceptions, employee departures, and incident exercises each need one accountable owner. The vCISO may own the process without performing every task. That is normal. What fails is a contract that names the vCISO as an adviser while management assumes the word "service" transfers accountability.

Acceptance tests should check use, not mere delivery. A risk register passes when leaders have reviewed its scoring method, owners acknowledge assigned treatments, and accepted risks carry an approver and review date. An incident plan passes when the people named in it can follow it during an exercise. A policy passes when the systems and employee behavior match it, or when documented exceptions explain the gap.

The risk register should identify the affected business objective, plausible event, existing controls, likelihood and impact method, owner, treatment, due date, and accepted residual risk. A list of vulnerabilities is not a risk register. It lacks the business consequence and management decision.

Policies need owners, approval dates, review dates, and a path to exceptions. A provider that supplies 25 generic policies in the first week may create more liability, because employees cannot follow rules that do not match the systems. I prefer fewer policies that describe reality, followed by controlled changes to reality.

Board reporting should show decisions and exposure, not technical volume. Counts of blocked emails or scanned endpoints rarely help directors. Material risks, overdue treatments, incidents, contractual commitments, and requested investments do.

Exclusions can cost more than the retainer

The apparent monthly price is incomplete until you identify excluded labor, software, assessments, and surge work. Small companies often compare retainers while leaving those extras in different columns.

Common separate charges include compliance platforms, external audits, penetration tests, privacy counsel, forensic response, employee training software, vulnerability scanning, and hands-on remediation. None of these exclusions is suspicious by itself. Trouble starts when a sales conversation implies an outcome that depends on them but the proposal does not estimate or assign them.

Watch questionnaire language closely. A provider may include "questionnaire support" but cap it at one short review per month. A 300-question enterprise form plus evidence requests can consume days. Define a unit, such as one questionnaire up to a stated length, and agree on overflow pricing before sales needs a response tomorrow.

Travel, after-hours calls, and incident surge rates also deserve a line. Ask whether unused hours roll over, whether additional hours require approval, and whether the fee rises during an audit. If the provider uses subcontractors, require confidentiality terms and disclosure of where company data goes.

Tool resale creates another conflict. A vCISO may reasonably recommend software and may receive partner pricing. Ask it to disclose commissions or reseller margin and document why the tool fits. The decision record should survive a change of provider.

Price increases need a mechanism. A 12-month agreement can state an annual review, while a month-to-month retainer can require notice before a rate or scope change. Do not accept a low entry price with undefined "standard pricing" after the first quarter.

Insurance deserves separate attention. A vCISO can help assemble accurate answers and identify gaps, but the broker and carrier control coverage terms. Never let a provider promise that its retainer will secure a particular premium or claim outcome. Require the company executive who signs the application to review material answers, because a consultant cannot transfer that accountability.

Audit language needs the same restraint. Readiness work improves the chance that controls operate and evidence exists; it cannot guarantee an auditor's opinion. If one firm sells both readiness and the independent assessment, verify that the arrangement preserves the required independence for the engagement. A lower combined price is not useful if the final report cannot satisfy the customer that asked for it.

Match the tier to the business trigger

Choose the lowest tier that provides enough authority and capacity for the next 12 months, then raise it when a specific trigger appears. Buying prestige wastes money; underbuying leaves a founder with polished documents and the same unresolved decisions.

Limited advisory usually fits when the company has one product, a technically strong owner, no immediate audit, few questionnaires, and low regulatory complexity. The vCISO reviews choices and keeps the risk conversation honest. Internal people execute.

A program retainer fits when enterprise prospects request evidence, a formal audit has a date, cyber insurance asks detailed questions, or work crosses engineering, HR, legal, and operations. Those dependencies require regular follow-through. A quarterly adviser will spend each meeting rediscovering why tasks stalled.

Embedded leadership fits when security affects weekly revenue decisions, the board expects reporting, several frameworks overlap, an acquisition is active, or multiple teams need direction. It also fits temporarily after an incident or during a major compliance push, provided the agreement allows the scope to step down later.

Use this buying sequence:

1. Write the three business outcomes you need, such as passing buyer diligence without false claims, assigning incident authority, or reaching audit readiness.
2. List internal owners and the hours they can actually spend. Missing execution capacity must appear in the quote or in a separate hiring plan.
3. Ask each provider for the same cadence, deliverables, limits, exclusions, and access terms.
4. Score the named vCISO's relevant operating experience, not the firm's combined biography.
5. Contract for an initial term with a 30-, 60-, or 90-day review tied to observable outputs.

Do not select on framework badges alone. Certifications can prove study and baseline knowledge. They do not show whether someone can tell a founder that a promised sales deadline creates unacceptable exposure, or persuade an engineer to fix an unglamorous access-control gap.

Interview the person who will do the work

The best proposal still fails if the assigned vCISO cannot make decisions with your team, so interview that person before signing. Do not accept a sales partner as a substitute unless that partner will remain the named lead.

Give candidates a real, sanitized conflict. For example: an enterprise prospect wants a security claim that the product cannot yet support, the deal matters, and engineering needs six weeks to close the gap. Ask what they do in the next 48 hours. A strong answer separates the factual response to the customer, temporary safeguards, remediation owner, acceptance authority, and record of residual risk. A weak answer promises to "work toward compliance."

Ask for a redacted monthly report, risk entry, and board slide. You are checking how the person thinks, not collecting reusable templates. Good artifacts name decisions, owners, deadlines, and uncertainty. Decorative maturity charts without source data should count against the bidder.

References should match your situation. A provider who guides large banks may struggle with a founder-led software company, and the reverse is also true. Ask a reference how much time the named senior person actually spent, what work cost extra, and what changed after the first quarter.

Check independence. The vCISO should state when it also sells the implementation, audit preparation, managed security, or software it recommends. Bundled delivery can reduce coordination, but management still needs to know who evaluates the work and who profits from expanding it.

Finally, discuss exit before entry. You should retain your policies, risk register, evidence map, decision history, vendor records, and incident materials in usable formats. The contract should require a handoff and revoke provider access. A vCISO relationship has worked when the company's security decisions become clearer, not when the company becomes unable to operate without the consultant.

The first 90 days should change decisions

A new vCISO should produce an agreed baseline, a ranked plan, and a repeatable management cadence within the first 90 days. The exact documents vary, but leaders should know what can hurt the business, who owns each treatment, what they have accepted, and what requires funding.

In the first month, the vCISO should learn the business model, important data, architecture, commitments, prior incidents, vendors, and current controls. Discovery must include interviews and evidence, not only questionnaires. Immediate dangerous gaps should move straight to action rather than wait for a final report.

By the second month, management should approve a risk method, top risks, treatment priorities, roles, and meeting cadence. The roadmap needs realistic internal capacity. Ten high-priority projects assigned to one busy engineer are an admission that prioritization never happened.

By the third month, the company should have held its operating review, closed or advanced urgent items, tested at least one management process, and produced an executive report based on evidence. The test might be an incident tabletop, access review, restore exercise, or customer-response workflow, depending on the risks.

Renewal should depend on movement and decision quality, not document count. Compare the starting baseline with closed risks, aged exceptions, fulfilled contractual commitments, response readiness, and overdue work. Some risk will remain; the point is that management sees it and chooses deliberately.

Paying $2,000 for advice when you need an operator is expensive because the work stalls. Paying $12,000 for embedded leadership when a CTO only needs a monthly challenge is wasteful. Define the decisions, access, artifacts, and execution boundary first. The correct vCISO price becomes much easier to see once every bidder is pricing the same job.