Virtual CISO (vCISO)

Big picture security leadership, without the full-time salary

The security work that needs a senior person does not add up to a full-time job at your size. A vCISO is how you get the seniority without the headcount. Fractional CISO and vCISO describe the same engagement. We say vCISO.

Your vCISO gets to know your business and helps you make timely decisions about what risk to accept and what to spend. They are an experienced CISO, not a consultant with a framework, and they work with only a handful of clients at a time.

Part of what you hire in an experienced CISO is who they already know. Our relationships open pricing on hardware and tooling that a company your size cannot reach on its own, and you buy direct at that pricing. We never purchase or resell on your behalf and we take no vendor margin, so the saving lands on your invoice, not ours. We consolidate what can be consolidated, and invest where it actually lowers risk. What a security executive actually provides is trust. Your team cannot audit the work, so the judgment has to be worth relying on. We earn that by having no stake in what you buy.

You will meet your prospective vCISO on the first full call and get to know them before you buy, not weeks later, after someone has been hired to fill the seat.

The goal is that you stop being a fifty-person company. A company of five hundred should have a full-time CISO. If that turns out to be your vCISO, we are not going to talk you out of it.

What your vCISO does:

• Advises leadership (you, the owner or CEO) on risk, and keeps the risk register current with periodic leadership reviews

• Reports weekly on project status and monthly on security posture, plus board slides each quarter if you want them

• Makes the security program fit how your business actually operates

• Takes command of incident response and makes the hard calls

• Prepares your business for audits and customer demands without slowing you down

When your customers start asking

Security questionnaires get longer. Contracts get renegotiated. Sales slow. Those are revenue costs.

A decision that was reasonable for a forty-person company becomes reckless once the business doubles or signs larger customers.

Insurers, auditors, lenders, regulators and enterprise customers want evidence that cyber risk is governed, not discussed. We build the program that produces it. When the questionnaire arrives, your vCISO answers it.

Passing the questionnaire is not the goal. Plenty of programs are built to pass the test, not to survive the incident. Your customers are now applying the standard you apply to your own suppliers.

If you already have a CISO, a merger or a fast expansion hands them a second full-time job. We take part of it.

Your vCISO and your MSP

These are two jobs, not two vendors competing for one. We do not replace your MSP.

Your MSP

• Keeps the environment running and patched

• Implements and operates the controls

• Runs support and the service desk

• Does the remediation work

• Reports on systems

Your vCISO

• Decides which risks the business accepts

• Chooses which controls you need

• Owns the risk register and the reporting to leadership

• Sets the remediation priorities, agreed with your MSP

• Answers to your customers, insurers, auditors and regulators

An MSP is accountable for systems running. A CISO is accountable for the decisions about risk and for defending them outside the company. Work we identify inside the environment goes to your MSP, not to us.​

What does a vCISO cost?

Stoic Cybersecurity vCISO engagements start at $4,750 per month, or $57,000 a year. The frameworks you have to satisfy and the condition of your program when we start set the number, not headcount alone: a fifty-person defense contractor working toward CMMC is more work than a larger company with no compliance obligation.

A CISO with real operating experience earns $221,000 to $371,000 in base salary, a hire your company was never going to make. Your MSP or IT team keeps the work it does today, and where our vendor relationships lower what you pay for hardware or tooling, that saving goes to you. Each Stoic vCISO commits no more than 32 hours a week to client work. That is why you get real time with yours, and why we still have capacity when something breaks.

Talk to a vCISO

The first call is with the vCISO who would do the work. Bring whatever is driving it: the questionnaire, the audit, the contract, the person who left.

​

​

​​

 

Common questions

What is a vCISO?

A vCISO is an experienced Chief Information Security Officer working for you part time. They own the security program and report to your leadership. Fractional CISO and vCISO mean the same thing.

Do I need a vCISO if I already have an MSP?

Your MSP runs your technology. A vCISO owns the decisions about risk and answers for them. We work alongside your MSP. We do not take over what they already do.

Is my company too small for a vCISO?

If a customer has sent you a security questionnaire, you are not too small. If you have no compliance obligation and no enterprise customers, a vCISO is probably more structure than you need right now.

Do I need a vCISO or a cybersecurity manager?

A manager implements controls. A vCISO decides which controls you need and defends that decision outside the company. If what you need is someone to run the tools, hire a manager.

Does my compliance framework require a CISO?

Several do. If yours names a CISO or a senior security officer as a required role, a vCISO fills it.

Will I get the vCISO I meet, or someone else?

The one you meet. You will meet your prospective vCISO on the first full call, before you buy.

How much does a vCISO cost for a 50-person company?

Stoic Cybersecurity vCISO engagements start at $4,750 per month, or $57,000 a year. The frameworks you have to satisfy and the condition of your program when we start set the number. A CISO with real operating experience earns $221,000 to $371,000 in base salary.