What is the difference between a virtual CISO and a fractional CISO?

In practice very little. Both are named executives working part-time for your organization. Fractional usually implies a fixed share of one person's week; virtual is the broader term and may be scaled up or down month to month. Ask about the time commitment and continuity arrangements rather than the label.

What do vCISO services typically include?

A security strategy and roadmap, a risk register and risk management process, a policy framework and governance cadence, board and executive reporting, third-party risk management, incident response leadership, and audit readiness for frameworks such as SOC 2, ISO 27001, PCI DSS, HIPAA or CMMC. Technical implementation is usually excluded and handled by your IT team or a managed service.

Can a vCISO satisfy the NYDFS CISO requirement?

Yes. 23 NYCRR 500.4 allows the CISO to be employed by a third-party service provider, provided the covered entity retains responsibility for compliance, designates a senior member of its own personnel to direct and oversee the provider, and requires the provider to maintain a cybersecurity program protecting the entity. The vCISO still delivers the annual written report to the board.

How many days a month does a vCISO work?

Most engagements run between two and eight days a month, with more in the first quarter and around audits or incidents. The right number depends on regulatory load, company size and whether you have an internal security team to direct. A provider who quotes a number before discovery is guessing.

When should a company hire a full-time CISO instead?

When the security organization is large enough to need a full-time leader, when regulators or customers insist on an employee in the role, or when the workload is clearly full-time and sustained. Many companies use a vCISO to build the program and define the role, then hire a full-time CISO into a function that already works.

Does a vCISO perform penetration tests or run security tools?

No. A vCISO decides what should be tested, how often and why, reads the results and turns them into risk decisions and roadmap items. The testing itself is done by penetration testers, and tool operation by your IT team or a managed service. A vCISO from a firm with an offensive practice can commission and interpret testing with more precision.

2 November 2026 · 10 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)

What is a virtual CISO (vCISO)? What the role covers, when you need one, and how to evaluate a provider

Q: What is a virtual CISO?

A virtual CISO is a senior security executive engaged part-time, on retainer or by project, to lead an organization's security program: strategy, risk management, policy, compliance posture, vendor risk, incident leadership and board reporting. The role is the same as a full-time CISO; the engagement model and the time commitment differ.

A virtual CISO gives an organization executive-level security leadership without a full-time executive hire. The model has moved from a stopgap for small companies to a standard option for US mid-market firms under regulatory pressure. This guide explains what the role actually covers, how it compares with the alternatives, and how to tell a real vCISO from a consultant with a new title.

Talk to us about security consulting

A virtual CISO, defined

A virtual CISO (vCISO) is an experienced security executive engaged on a part-time, retained or project basis to own an organization's security program: strategy, risk management, policy, compliance posture, vendor risk, incident leadership and reporting to the board. The word virtual refers to the engagement model, not the location. A vCISO attends your leadership meetings, signs off on your risk register and presents to your board; they simply do it for a defined number of days a month, usually alongside a small number of other clients, and usually remotely with on-site presence at agreed moments.

The model exists because the role is scarce and the obligation is not. US regulators increasingly expect a named, qualified individual to be accountable for cybersecurity: NYDFS Part 500 requires covered entities to designate one, the SEC requires public companies to disclose management's role and expertise in cyber risk, and HIPAA requires an assigned security official. In the EU, NIS2 and DORA make management bodies personally accountable for cyber risk oversight. A company with 300 employees and a regulated customer base needs that accountability filled, but rarely has a full-time workload or the hiring pull for a seasoned CISO. vCISO services close that gap.

Three terms circulate for roughly the same idea. Virtual CISO and fractional CISO are near synonyms, with fractional usually implying a fixed share of a named person's week. CISO as a service usually describes a firm-level offering in which a team, not one individual, delivers the function under a service agreement. The differences matter for continuity, independence and regulatory acceptability, which is why the next section compares them with the full-time hire.

vCISO vs fractional CISO vs full-time CISO vs CISO as a service

How the four models differ in practice. Labels vary between providers; use the rows, not the column names, when you read a proposal.

Dimension	Virtual CISO	Fractional CISO	Full-time CISO	CISO as a service
What it is	Named senior executive on a retainer, part-time	Named executive committed to a fixed fraction of their week	Employed executive, full workload	A firm delivers the CISO function through a team under an SLA
Who you get	One accountable person, often with a backup from their firm	One accountable person	One employee plus whatever team you fund	A lead plus specialists (GRC, architecture, incident response)
Time commitment	Typically two to eight days a month, scaled to need	Fixed, for example two days a week	Full-time, plus on-call	Defined deliverables and hours, often more elastic
Continuity	Depends on the individual and the firm behind them	Depends on the individual	Highest while they stay; average tenure is short	Highest institutional continuity; personal relationship weaker
Independence from tooling	High if the firm sells no products	High	Varies; internal politics apply	Check whether the firm resells the tools it recommends
Cost logic	Retainer scaled to days; no recruitment, equity or benefits	Fraction of an executive package	Full executive package plus recruitment and retention	Service fee tied to scope and deliverables
Regulatory acceptability	Accepted by NYDFS 500.4 if the entity retains responsibility and names a senior internal overseer	Same as vCISO	Simplest to evidence	Accepted; name the lead individual in filings
Best for	Mid-market firms with a regulatory trigger and no executive-level security leadership	Companies that want one person embedded on a predictable rhythm	Enterprises with a large security organization to lead	Companies that need breadth of skills more than one personality

What a vCISO actually does

Six areas of work recur in every serious vCISO engagement. If a proposal covers fewer than four, you are buying advice, not leadership.

Strategy and roadmap

Translate business goals, threat exposure and regulatory obligations into a multi-year security strategy and a prioritized 12-month roadmap with owners, milestones and funding asks. The roadmap is the artefact the board, the auditor and the next CISO will all read.

Risk register and risk management

Build and maintain the enterprise cyber risk register: identify risks, score likelihood and impact against a method the business already uses, assign owners, decide treatment, and track residual risk. This is where offensive testing results become business decisions.

Policy framework and governance

Write or rationalize the policy set (acceptable use, access control, vendor management, incident response, data classification), align it to ISO 27001, NIST CSF 2.0 or SOC 2, and run the governance cadence: steering committee, exceptions process, metrics review.

Board and executive reporting

Report security posture to the board in business terms: top risks, trend, control maturity, incidents, regulatory status, and the decisions required. Under NYDFS 500.4(b) and the SEC governance disclosures, this reporting is itself a compliance artefact.

Vendor and third-party risk

Own the third-party risk process: tiering of suppliers, security due diligence, contract clauses, continuous monitoring of critical vendors, and the evidence SOC 2 CC9 and DORA's ICT third-party rules expect. A growing share of mid-market breaches arrives through a supplier.

Incident leadership and audit readiness

Lead the incident response plan, run tabletop exercises, act as incident commander or executive liaison when something happens, and manage regulatory notification clocks. Between incidents, prepare the organization for SOC 2, ISO 27001, PCI DSS or CMMC audits.

When you need a vCISO

Seven triggers account for most engagements. Two or more at once is the usual starting point.

A growth trigger: your first enterprise customers send 200-question security questionnaires and ask for a SOC 2 report or ISO 27001 certificate, and nobody owns the answer.
A regulatory trigger: you fall under NYDFS Part 500, HIPAA, CMMC 2.0 Level 2, PCI DSS v4.0.1, NIS2 or DORA, and the framework expects a named accountable security leader and board-level reporting.
A post-incident trigger: a breach or near miss has shown that technical controls existed but nobody owned risk, priorities or communication with executives and regulators.
An M&A trigger: due diligence by a buyer or investor, or the integration of an acquired company, requires an independent view of security posture and a remediation plan with a credible owner.
A gap between hires: the CISO has left, recruitment takes six to twelve months, and the program cannot drift in the meantime.
Board or investor pressure: directors ask for a cyber risk report and the IT director, however capable, cannot present risk in the language the board uses.
Cyber insurance: the carrier's application asks who is responsible for the security program, and the renewal depends on controls that need an owner to land.

What to expect in the first 90 days

A credible vCISO arrives with a plan for the first quarter. This is the shape it should take.

Weeks 1 to 2: discovery

Interviews with executives, IT, legal, HR and product; review of existing policies, audit findings, penetration test reports, incident history and insurance terms; an inventory of crown-jewel systems and data flows. Output: a documented understanding of what the business is, what it must protect and what it has promised to whom.

Weeks 3 to 4: risk and maturity baseline

A structured cybersecurity maturity assessment against NIST CSF 2.0 or CIS Controls v8.1, a first version of the risk register with the top ten risks scored and owned, and a gap list against the regulations that apply. Output: a baseline the roadmap can be measured against.

Month 2: roadmap and early wins

A prioritized 12-month roadmap approved by the executive team, and a handful of early measures that reduce risk visibly: multi-factor authentication coverage, backup verification, logging of critical systems, patching cadence with owners, a working incident contact list. Output: momentum and credibility with the technical teams.

Month 2: governance cadence

A security steering committee with a fixed rhythm, a policy framework with a review calendar, an exceptions process, and a metrics set the board will see every quarter. Output: security decisions that happen on a schedule instead of in a crisis.

Month 3: board report and funding plan

The first board report in business language: top risks, maturity, regulatory status, incidents, and the decisions and investment required for the roadmap. Output: a board that knows what it is accountable for and has approved the plan to address it.

Month 3: validation plan

A testing calendar that checks whether controls work as described: penetration testing of the crown-jewel applications and external perimeter, a tabletop exercise with the executive team, and a decision on continuous monitoring or MDR. Output: the self-assessment replaced by evidence.

How to evaluate a vCISO provider

Ten checks, in roughly the order they decide the outcome.

Operating experience: has the named individual held CISO, deputy CISO or head-of-security responsibility in an organization of comparable size and regulatory exposure, not only advised one?
Credentials in context: CISSP, CISM or CCISO show governance literacy; CRISC or CISA show risk and audit depth; none replaces the operating experience above.
Sector and regulatory experience: have they taken an organization through the specific frameworks you face (NYDFS, HIPAA, CMMC, PCI DSS, SOC 2, ISO 27001, NIS2, DORA) and can they show redacted deliverables?
Independence from tooling: does the firm resell or take commission on the products it will recommend? A vCISO who earns from your tooling spend is a salesperson with a governance title.
Technical grounding: can they read a penetration test report, challenge a CVSS score with business context and ask the right questions of your architects? Advisory firms with an offensive practice have an advantage here.
Named person plus continuity: who exactly will you get, how many other clients do they carry, and who covers holidays, illness and a 03:00 incident?
Availability for incidents: what is the arrangement when a breach happens outside the retained days, and how does it connect to an incident response retainer or MDR service?
References: two clients of similar size you may call, including one that has been through an audit or an incident with this vCISO in post.
Professional indemnity insurance and a written scope that states what the vCISO decides, recommends and is accountable for, so your regulator and insurer can see the line.
Handover: how does the engagement end? A good vCISO leaves a roadmap, a risk register, a policy set and a board the next leader can inherit.

Compliance hooks: where the frameworks expect security leadership

None of these texts says vCISO. All of them require a function that an external executive can fill, provided the organization keeps accountability.

NYDFS 23 NYCRR 500.4: covered entities must designate a qualified individual responsible for the cybersecurity program; that person may work for a third-party service provider if the entity retains responsibility, names a senior member of personnel to oversee them and requires the provider to maintain its own program. The CISO reports to the board in writing at least annually.
SEC cybersecurity disclosure rules (2023): Regulation S-K Item 106 requires public companies to describe management's role and expertise in assessing and managing cyber risk and the board's oversight; Form 8-K Item 1.05 requires disclosure of a material incident within four business days of the materiality determination.
HIPAA Security Rule 45 CFR 164.308(a)(2): covered entities and business associates must identify the security official responsible for developing and implementing the required policies and procedures.
SOC 2 Trust Services Criteria: CC1 (control environment, including defined reporting lines and authorities), CC3 (risk assessment) and CC9 (risk mitigation including vendor management) are the criteria auditors test for security governance.
ISO 27001:2022 clause 5: leadership and commitment (5.1), the information security policy (5.2) and assigned roles, responsibilities and authorities (5.3) are mandatory clauses, not optional controls; the certification auditor will ask who holds them.
CMMC 2.0 Level 2 and PCI DSS v4.0.1: both require documented security responsibilities, formally assigned, and executive management accountability for the program (PCI DSS Requirement 12.1 and 12.4).
EU: NIS2 Article 20 makes management bodies responsible for approving and overseeing cybersecurity risk measures, requires them to follow training and allows member states to hold them liable; DORA Article 5 places ultimate responsibility for ICT risk management with the management body of a financial entity.

A vCISO versus the people already in the room, and where HackersHub fits

A vCISO is not a replacement for your IT director, who runs systems; for your MSSP or MDR provider, who operates controls and responds to alerts; for your external auditor, who gives an opinion on evidence; or for a project consultant who delivers one framework implementation and leaves. The vCISO is the person who decides what all of those should be doing, in what order, and tells the board whether it is working. The sharpest test of whether you have one is to ask who signed the risk register and who presented it upstairs. If the answer is nobody, the role is vacant whatever the org chart says.

HackersHub does not place vCISOs. We are an offensive security firm with more than ten years of breaking into enterprise environments, and our security consulting practice supports the work a vCISO, or a full-time CISO, has to get done: security strategy and roadmap, risk assessment, audit readiness for the frameworks above, and offensive validation through penetration testing and red teaming that turns a self-assessment into evidence. That background changes the advice: we read penetration test and red team reports every week, we know which findings matter to an attacker and which only matter to a scanner, and we do not sell the tools we recommend. Engagements are scoped per organization, for clients in the EU and the US, delivered remotely with on-site presence at agreed moments. If you are unsure whether you need an assessment or a test first, our cybersecurity maturity assessment explainer describes how a program is baselined, and our guide to whether penetration testing is required by law shows which obligations your vCISO will be tracking.

Frequently asked questions

Related guides and services

Building the program your vCISO will lead?

Tell us where the program stands and which regulators and customers you answer to. Our security consulting practice covers strategy, risk assessment, audit readiness and offensive validation, and we will tell you honestly whether an assessment or a test comes first. Schedule a call with an expert.

Security consulting Schedule a call