"What is a vCISO" is usually the first question. "What does it cost" is the second, and it's the one that actually determines whether the conversation goes anywhere. Budget owners need a number to plan around, and "it depends" — while true — isn't useful on its own.
Here's the honest breakdown: what fractional CISO engagements actually cost, what drives the number up or down, and how to tell whether a quote reflects real value or just a discount on a service that won't hold up when you need it.
The Three Pricing Models
Most vCISO engagements are structured one of three ways.
Monthly retainer. The most common model. You're buying a defined block of hours or a defined scope of responsibility each month, billed on a recurring basis. This works well for ongoing program leadership — the ongoing work of running a security program doesn't stop, so neither should the engagement.
Hourly or block-of-hours. Common for organizations that need on-demand strategic input rather than ongoing leadership — a few hours a month for board prep, policy review, or ad hoc advisory. Cheaper on paper, but it rarely produces the outcomes a retainer does, because nobody is accountable for moving the program forward between calls.
Project-based. A flat fee for a scoped deliverable — a SOC 2 readiness assessment, a HIPAA gap analysis, a security architecture review. Useful when you have a defined milestone (an audit, an acquisition, a board requirement) rather than an ongoing need for leadership.
What Actually Drives the Price
Four factors explain almost all of the variance you'll see between quotes.
Hours committed per month. This is the biggest lever. A vCISO providing 10 hours a month of strategic guidance costs a fraction of one providing 40 hours a month of hands-on program leadership, vendor management, and execution oversight.
Compliance scope. Pursuing SOC 2 Type II is a different workload than maintaining SOC 2 while also managing HIPAA obligations for a healthcare client base, or layering in PCI DSS because you started processing payments. Each additional framework adds ongoing evidence collection, control mapping, and audit coordination — real hours, not just a line item.
Company complexity. A 60-person company with one AWS account and a handful of SaaS tools has a fundamentally smaller attack surface — and smaller workload — than a 300-person company running multiple cloud environments, a mix of on-prem and cloud infrastructure, and a sprawling vendor list. The vCISO's job scales with what they're responsible for overseeing.
Maturity stage. Building a program from zero — writing the first set of policies, standing up the first risk register, getting basic controls in place — takes more hands-on time than refining and operating a program that already has a foundation. Early engagements often run heavier than steady-state ones, then taper as the program matures.
Realistic Price Ranges
These are the ranges I see consistently in the mid-market:
- Lean / early-stage (10–15 hours/month): roughly $3,000–$6,000/month. Typically strategic advisory, light policy work, and board-level guidance for companies without an active compliance deadline.
- Active compliance push (20–30 hours/month): roughly $6,000–$12,000/month. The common profile for a SaaS company driving toward SOC 2 Type II or a healthcare tech company addressing HIPAA — there's a defined goal and a timeline, and the work is genuinely full of substance.
- Larger mid-market, multi-framework, embedded leadership (35–50+ hours/month): roughly $12,000–$20,000+/month. This looks closer to a part-time executive — regular leadership team involvement, vendor oversight, incident response readiness, and board reporting.
- Project-based engagements (a SOC 2 readiness assessment, a gap analysis, an M&A security due diligence review) typically run as flat fees in the $5,000–$25,000 range depending on scope, separate from any ongoing retainer.
What You're Actually Comparing It To
Run the math against a full-time hire and the value proposition gets clear fast. A full-time CISO in the mid-market commands $200,000–$400,000+ in base salary alone, before bonus, equity, benefits, and the recruiting cost and ramp time that come with any executive hire. Even a heavy vCISO engagement at $20,000/month — $240,000/year — comes with no benefits overhead, no equity dilution, and expertise from day one rather than a 90-day ramp.
The real comparison isn't "vCISO vs. nothing." It's "vCISO vs. a full-time hire you can't yet justify" or "vCISO vs. the status quo, where security decisions are being made by whoever has the most spare time this quarter."
How to Evaluate a Quote
Price alone tells you less than you'd think. Before comparing numbers, ask:
- What's actually included? Hours per month, specific deliverables, response time expectations for incidents, and whether board or executive reporting is part of the scope.
- What happens when more is needed? Compliance deadlines slip, incidents happen, audits run long. Know the process — and the cost — for scope changes before you sign anything.
- Who else is involved? A vCISO provides leadership and strategy, not hands-on implementation. If a quote seems to bundle in "everything," ask who's actually doing the configuration, monitoring, and remediation work.
Be especially skeptical of quotes well below the ranges above. A vCISO engagement priced to win the deal rather than to cover the actual work tends to either under-deliver or quietly expand in scope once the relationship starts.
Ready to find out what a fractional CISO engagement would actually look like — and cost — for your organization? Schedule a free consultation with ProTechtive.