Key Numbers
| vCISO | Full-Time CISO | |
|---|---|---|
| Annual cost | $36K - $96K | $250K - $450K |
| Time to start | 1-2 weeks | 3-6 months hiring |
| Commitment | Part-time, flexible | Full-time employee |
| Best for | 10-500 employees | 500+ employees |
| Compliance readiness | Yes (ISO, SOC2, GDPR) | Yes |
| Board reporting | Yes | Yes |
When a vCISO Makes Sense
Company has no CISO and needs compliance (ISO 27001, SOC 2, GDPR)
Post-incident: needs immediate expertise without a 6-month hiring process
Pre-Series B/C: investors require security posture, not ready for full-time hire
Growth phase: security requirements are scaling but budget is limited
M&A due diligence: needs CISO-level assessment for a transaction
When a Full-Time CISO Makes Sense
500+ employees with a dedicated security team
Regulated industry (finance, healthcare) with daily compliance obligations
Security is core to the product (SaaS selling to enterprise)
Board requires named, accountable executive for security
Cost Breakdown
Full-Time CISO - Total Cost
Base salary $280K - $380K
Bonus (20-30% of base) $56K - $114K
Equity (0.1% - 0.5%) Variable
Benefits + employer costs (~30%) $84K - $114K
Total per year $400K - $600K
Plus 3-6 month hiring timeline
vCISO - Total Cost
Monthly retainer $3,000 - $8,000
Project-based rate $150 - $350/hr
No equity required $0
No benefits overhead $0
Total per year $36K - $96K
Available in 1-2 weeks