A vCISO, a virtual Chief Information Security Officer, is a senior security leader you retain part-time instead of hiring a full-time executive. For most companies between 20 and 500 people, that arrangement closes the gap between having no security strategy and affording a six-figure hire. This guide covers when the model fits, what it costs, and how it compares to the alternatives.
What does a vCISO actually do?
A vCISO owns your security strategy, risk decisions, and compliance posture without being a full-time employee. They set priorities, translate frameworks like ISO 27001 and NIS2 into an engineering backlog, run vendor and audit conversations, and act as the accountable security voice to your board, customers, and regulators.
- ▸Strategy and roadmap: a risk register, a prioritized 12-month plan, and a budget you can defend.
- ▸Governance: policies, an ISMS, access reviews, and evidence that survives an audit.
- ▸Compliance translation: mapping GDPR, NIS2, DORA, SOC 2, or ISO 27001 to concrete controls.
- ▸Incident leadership: owning the response plan and running the room when something breaks.
- ▸Third-party assurance: answering security questionnaires and passing enterprise buyer reviews.
- ▸Program building: hiring the first analyst, choosing an MSSP or MDR, and standing up detection.
A vCISO is deliberately not hands-on-keyboard. They do not patch servers or triage alerts at 2 a.m.; they design the system that decides who does. If your real gap is engineering leadership rather than security specifically, compare the model with What a Fractional CTO Actually Does (and When Your Startup Needs One).
How do you know you need a vCISO?
You likely need a vCISO when security decisions pile up with no clear owner, an enterprise prospect just sent a 200-line security questionnaire, a regulation like NIS2 now applies to you, or you handle sensitive data but nobody is accountable for protecting it. Recurring triggers, not company size, drive the decision.
- ▸A big customer demands proof, SOC 2, ISO 27001, or a completed security questionnaire before they sign.
- ▸A regulation reaches you, NIS2, DORA, GDPR enforcement, or sector rules that name a responsible security function.
- ▸You raised funding and investors ask who owns security and business continuity.
- ▸You had a near-miss or breach and the review found no owner.
- ▸Headcount crossed roughly 20 to 50 and "the CTO handles it" no longer scales.
- ▸Cyber insurance renewal now asks for controls you cannot yet evidence.
If several of these are true at once, the gap is leadership, not tooling. A structured baseline like The 2026 SME Cybersecurity Checklist for GDPR, NIS2 and DORA helps you see how many of these obligations already apply to you.
vCISO vs in-house CISO vs security consultant: what is the difference?
A security consultant delivers a defined project and leaves; an in-house CISO is a full-time executive who owns security continuously; a vCISO sits between them, ongoing accountability and leadership, but fractional time and cost. The real differentiator is durable ownership: consultants advise, a vCISO is answerable for outcomes.
- ▸Consultant or auditor: a scoped engagement such as a pen test or gap assessment. Great for point-in-time work; no lasting ownership.
- ▸vCISO: retained leadership, typically a few days a month, accountable for the program over quarters and years.
- ▸In-house CISO: full-time and deeply embedded, justified once security is core to revenue or headcount passes roughly 200 to 500.
- ▸MSSP or MDR: operates tooling and monitoring; it is a hands-on capability the vCISO directs, not a substitute for strategy.
A common mistake is buying an MDR subscription and assuming strategy is covered. Monitoring answers whether something is happening; a vCISO answers what you should be doing and in what order. See how that economics plays out in Cyber Insurance and Affordable MDR: The New Economics of SME Resilience.
What does a vCISO cost?
vCISO engagements are typically retainer-based and priced by the days per month you need, often a few thousand to low five figures monthly, versus a full-time CISO whose total EU compensation frequently runs 150,000 to 300,000 euros a year plus equity. The model converts a fixed executive salary into a variable, scalable cost.
- ▸Retainer tiers: light-touch governance of a couple of days a month sits at the low end; active program build or audit season costs more.
- ▸Ramp versus steady state: expect a heavier first quarter for assessment, roadmap, and policies, then a lighter maintenance cadence.
- ▸What you avoid: recruiting fees, benefits, equity dilution, and the risk of a mis-hire in a scarce talent market.
- ▸Watch for: scope creep into hands-on work that belongs to an analyst or MSSP, that is where retainers quietly blow up.
What should a vCISO deliver in the first 90 days?
In the first 90 days a competent vCISO produces a risk assessment, a prioritized remediation roadmap, a short stack of core policies, and quick wins that reduce obvious exposure, MFA everywhere, verified backups, an incident contact tree. You should see artifacts and measurable risk reduction, not just meetings.
- ▸Weeks 1 to 3: asset and data inventory, a risk register, and a review of current controls against a framework.
- ▸Weeks 4 to 8: a prioritized roadmap tied to budget, plus core policies for access, incident response, acceptable use, and vendors.
- ▸Weeks 9 to 12: quick wins shipped, enforced MFA, tested backups, a logging baseline, and a first tabletop exercise.
- ▸Ongoing: a board-ready, one-page risk summary you can hand an investor or enterprise buyer.
The incident-response plan is where this becomes real; borrow structure from Incident Response Playbooks That Teams Actually Use, and keep audit evidence maintainable with the approach in ISO 27001 Evidence as Code: Building an ISMS Engineers Don't Hate.
When is a vCISO the wrong choice?
A vCISO is the wrong fit when you need continuous hands-on operations rather than leadership, when security is so core to your product that it demands a full-time executive, or when you have not resourced the execution the vCISO will direct. Strategy with nobody to execute it produces a shelf-ware roadmap.
- ▸You need operators, not a leader, if the gap is alert triage, buy MDR or hire an analyst first.
- ▸Security is the product, a fintech clearing money movement or a health platform at scale usually warrants a full-time CISO.
- ▸No execution capacity, a vCISO writes the plan, but someone has to do the patching, configuration, and evidence work.
- ▸You want a rubber stamp, a vCISO who signs off without changing anything is a liability, not a control.
How do you choose and onboard a vCISO?
Choose a vCISO on demonstrated leadership in your regulatory context and stage, not certifications alone. Verify they have run programs under the frameworks you actually face, define scope and days per month in writing, give them board access, and pair them with someone accountable for execution. Onboarding hinges on data access and a clear mandate.
- ▸Fit for your context: EU data-protection and NIS2 experience matters more than a generic certification if you serve EU customers.
- ▸Independence: be wary of providers who only recommend their own tools; you want vendor-neutral prioritization.
- ▸Defined scope: days per month, decision rights, on-call expectations, and escalation paths, all in the contract.
- ▸Access and mandate: read access to systems, a seat with leadership, and the authority to say no.
- ▸Execution partner: an internal engineer or an MSSP to turn the roadmap into shipped controls.
The first real test is often an external review; How to Pass a Security Audit for Your First Enterprise Client shows what that mandate has to produce.
How TuniCyberLabs helps
TuniCyberLabs provides vCISO and fractional security leadership for growing EU and North African companies, running risk assessments, building ISO 27001 and NIS2-ready programs, and directing detection and response through our engineering and SOC teams. We pair strategy with the people who execute it, so the roadmap ships instead of gathering dust.
Talk to our team about a vCISO engagement scoped to your stage, start with a conversation.