Most small and mid-sized businesses reach the same point eventually. The tooling is in place, an MSP or internal IT team keeps things running, and yet nobody senior owns the security decisions — what to fix first, what risk is acceptable, what to tell the board, how to answer the customer questionnaire that is holding up a contract.
That ownership is the job of a Chief Information Security Officer. The arithmetic rarely works at SMB scale: a full-time CISO is a senior executive hire, and most companies below a few hundred employees do not have forty hours a week of genuine CISO-level work.
So the question gets asked as "how much does a fractional CISO cost?" The more useful question is: what level of security leadership does this company actually need, and what should we expect to receive for the investment? Pricing moves with company size, security maturity, regulatory obligations, risk profile, scope, and how often the executive is involved. This guide covers all six.
What Is a Fractional CISO?
A fractional CISO — often called a virtual CISO or vCISO — is an experienced security executive who acts as your head of security on a part-time, contracted basis. The role sits at the leadership layer: direction, prioritization, and accountability, not day-to-day administration.
It is worth separating the role from three things it is regularly confused with:
- Not an MSP. A managed service provider runs infrastructure and operations. A fractional CISO decides what the program should look like and holds the MSP's security work to a standard.
- Not a consultant. A consultant delivers a report and leaves. A fractional CISO owns the roadmap over time and is accountable for progress against it.
- Not a full-time CISO. Same seniority, same responsibilities, less availability — and no employment overhead.
Typical responsibilities include security strategy, risk management, governance, roadmap development, policy and standards, compliance readiness, executive and board reporting, security budget planning, vendor and tool evaluation, incident preparedness, and steady improvement of program maturity. We describe how the role works in practice on our Fractional CISO service page and in What is a vCISO?
How Much Does a Fractional CISO Cost?
Fractional CISO cost is a function of scope, not a list price. The ranges below reflect general US market pricing and are intended for budgeting conversations. They are not Defensible's published rates, and any credible provider will quote only after understanding your environment.
| Engagement | Typical monthly range | Best for |
|---|---|---|
| Light advisory support | $2,000–$5,000 per month | Smaller organizations needing periodic strategic guidance |
| Standard fractional CISO | $5,000–$10,000 per month | Growing SMBs needing ongoing security leadership |
| High-touch fractional CISO | $10,000–$20,000+ per month | Complex environments, higher risk, compliance-heavy organizations |
| Full-time CISO | Significantly higher total employment cost | Larger organizations requiring dedicated executive leadership |
Some providers also sell hourly advisory or fixed-scope projects such as a risk assessment or SOC 2 readiness engagement. Those can be sensible starting points, but they buy a deliverable rather than ongoing accountability. Our CISO as a service pricing breakdown compares the models side by side.
The right number depends on your risk profile and how involved the executive needs to be. A twenty-person firm with one SaaS stack and no regulatory exposure and a two-hundred-person healthcare vendor preparing for HIPAA and SOC 2 are not buying the same thing.
What Determines Fractional CISO Pricing?
Company Size
Headcount is a rough proxy for complexity. What actually drives scope is the number of locations, systems, identities, third parties, and business units the leader has to cover. A distributed company with three offices and forty SaaS applications takes more executive time than a single-site company with the same headcount.
Security Maturity
Starting maturity is the single largest cost variable. An organization with no policies, no asset inventory, and no risk register needs months of foundational work before governance becomes routine. An organization with established controls needs oversight and refinement, which costs materially less. Our program maturity guide is a reasonable self-check.
Regulatory Requirements
SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, and sector-specific obligations each carry their own evidence, documentation, and review burden — and multiple frameworks at once compound it. A fractional CISO prepares the organization and manages the program; the certification or attestation itself comes from an independent auditor or assessor, not from the CISO.
Risk Profile
Companies handling financial, healthcare, legal, or proprietary data generally need more intensive leadership than companies with limited sensitive data. Contractual security commitments to enterprise customers and cyber insurance underwriting requirements push in the same direction.
Scope of Responsibilities
Strategic advisory is the narrowest scope. Adding security program management, compliance preparation, formal risk management, security architecture oversight, incident response planning, board reporting, or vendor management each expands the engagement. Decide which of these you actually need before comparing quotes.
Engagement Frequency
Some organizations need a few hours a month. Others need weekly leadership involvement, several days a week, or a near-embedded executive during a transformation, audit cycle, or transaction. Frequency is usually the difference between the second and third rows of the table above.
What Should a Fractional CISO Actually Deliver?
Hours are the weakest way to evaluate this purchase. Two providers can bill the same twenty hours and produce entirely different outcomes. Ask what will exist at the end of the first quarter that does not exist today.
Reasonable expectations include a current-state security assessment, a risk register that leadership actually reviews, a prioritized security roadmap, written policies and standards, a governance framework, security metrics, executive reporting, budget recommendations, compliance gap analysis, an incident response plan that has been exercised, vendor and tool assessments, a security awareness strategy, and ongoing oversight of the program.
The value is in leadership and outcomes — decisions made, risks reduced, audits passed — not in the number of hours billed.
Fractional CISO vs. Full-Time CISO
| Dimension | Fractional CISO | Full-time CISO |
|---|---|---|
| Cost | Monthly fee scaled to scope | Salary plus bonus, equity, benefits, recruiting |
| Availability | Scheduled time plus escalation path | Dedicated, daily presence |
| Strategic leadership | Executive-level, focused on priorities | Executive-level, continuous |
| Benefits and overhead | None | Full employment overhead |
| Breadth of expertise | Draws on patterns across many organizations | Deep knowledge of one organization |
| Flexibility | Scope adjusts up or down | Fixed commitment |
| Scalability | Suits changing needs and growth stages | Suits sustained, large-scale demand |
| Best use case | SMBs and mid-market without full-time need | Large or heavily regulated organizations |
A fractional CISO is not universally the better choice. Once security leadership requires daily presence — large internal security teams, continuous regulatory engagement, complex M&A activity, or a business where security is a core product concern — a full-time executive is the right answer. Many companies use a fractional CISO first and hire full-time later, sometimes with the fractional leader helping define the role.
Fractional CISO vs. MSP
These are different functions, and confusing them leads to gaps.
An MSP handles IT operations: infrastructure, help desk, device management, patching, network management, and operational support. That work is necessary and largely tactical.
A fractional CISO handles security strategy, risk, governance, compliance direction, the roadmap, and executive reporting. The role sets the standard the operational work is measured against.
The two complement each other well. In most engagements the fractional CISO defines requirements and priorities, and the MSP or internal IT team executes them. If your provider tells you an MSP relationship already covers security leadership, treat that as a gap rather than a reassurance.
Warning Signs When Comparing Fractional CISO Providers
- Selling hours rather than outcomes.
- No clearly defined deliverables in the statement of work.
- No security roadmap, or a roadmap that is really a product list.
- No executive or board reporting.
- Generic recommendations that could apply to any company.
- No apparent understanding of how your business makes money or where it is exposed.
- A one-size-fits-all program template.
- No measurable priorities or way to show progress.
- Any promise of complete security or guaranteed outcomes.
- Treating a compliance framework as the entire security program.
The cheapest proposal often signals the narrowest scope. That is fine if the scope matches your need, and expensive if it does not.
How SMBs Can Determine the Right Level of CISO Support
Match the level of support to the work in front of you.
Light support suits organizations that need periodic strategic guidance, a basic roadmap, policy review, and help prioritizing risk.
Ongoing fractional CISO suits organizations that need regular executive involvement, security program management, compliance preparation, active risk management, and someone driving roadmap execution.
High-touch or embedded support suits organizations with significant regulatory requirements, complex infrastructure, high-value data, multiple locations, rapid growth, active security transformation, or elevated risk from their industry or customer base.
Most companies move between these levels over time. A sensible engagement allows scope to change without renegotiating the relationship from scratch.
Questions to Ask Before Hiring a Fractional CISO
- What will you deliver during the first 30 days?
- How do you assess our current security maturity?
- How will you prioritize security investments?
- How frequently will we meet, and with whom?
- What executive reporting will we receive?
- How do you measure progress?
- How do you handle our compliance requirements?
- How will you work with our MSP or internal IT team?
- What is your role during a security incident?
- What expertise is included in the engagement, and what is billed separately?
Is a Fractional CISO Worth the Cost?
It depends entirely on whether the engagement produces leadership, prioritization, accountability, and measurable risk reduction. A retainer that generates meeting notes is not worth $6,000 a month. A retainer that gets a stalled SOC 2 program to audit, replaces a tool sprawl problem with a budget plan, and produces an incident response plan the leadership team has actually rehearsed usually is.
Do not buy a fractional CISO because it seems like something a company your size should have. Work through the questions first: What risks exist? Which decisions need executive security judgment? Where are the gaps? What regulatory obligations apply? What roadmap does the business need over the next year? What internal resources already exist? The answers determine the level of support — and the cost that goes with it. A security assessment is often the cheapest way to answer them.
Final Takeaway
The right fractional CISO is not the cheapest one. It is the one that provides the level of security leadership your organization's risk, maturity, and growth stage actually call for.
Used well, the model gives SMBs access to experienced security leadership without the cost and commitment of a full-time executive — and gives them a clear path to that hire if and when the business grows into it.
Frequently Asked Questions
How much does a fractional CISO cost?
General market ranges run roughly $2,000–$5,000 per month for light advisory support, $5,000–$10,000 for a standard ongoing engagement, and $10,000–$20,000+ for high-touch or embedded leadership. Actual pricing depends on scope, maturity, and regulatory requirements.
Is a fractional CISO cheaper than a full-time CISO?
In most SMB cases, yes — a full-time CISO carries salary, bonus, equity, benefits, and recruiting costs. The comparison is only fair if the fractional engagement covers the leadership work you actually need.
What does a fractional CISO do for an SMB?
Sets security strategy, owns risk and governance, builds and drives the roadmap, prepares the organization for compliance, reports to executives and the board, and directs the work of internal IT or an MSP.
How many hours a month does a fractional CISO work?
Commonly between a handful of hours and several days per week, depending on the engagement. Hours are a planning input, not a measure of value — judge the engagement on deliverables and outcomes.
Is a fractional CISO worth it?
It is worth it when the organization has real security decisions that need executive ownership and no one internally qualified to make them. It is not worth it as a checkbox purchase.
What is the difference between a vCISO and a fractional CISO?
The terms are used interchangeably in the market. "Virtual" tends to emphasize remote delivery and "fractional" the part-time arrangement; compare scope and deliverables rather than titles. See our vCISO services for how we define it.
When should an SMB hire a full-time CISO?
When security leadership needs daily presence — a growing internal security team, continuous regulatory engagement, or a business where security materially shapes the product or sales cycle.
Talk It Through
Need help determining what level of security leadership your organization actually needs? Defensible can assess your current security maturity, identify priorities, and help you decide whether a fractional CISO engagement makes sense.
