What is a vCISO? When a fractional security chief makes sense — and when it doesn't

TL;DR: A vCISO is a rented security executive: strategy, program, and board-facing accountability at a fraction of a full-time cost. The model works for companies that need direction more than headcount — and fails when a company needs an operator, buys an adviser, and assumes the risk moved to the invoice.

What does a vCISO actually do?

The competent version of the job looks like the first year of any CISO tenure, compressed: assess the current state, build a risk register the leadership team actually reads, set a roadmap, stand up the essential policies, prepare the company for customer security questionnaires and audits, and represent security to the board, customers, and insurers. What a vCISO does not do is run daily operations — they direct whoever does, whether that's an IT lead, an MSSP, or a small internal team.

When does the model make sense?

Four situations recur. The compliance trigger: a large customer, an auditor, or a regulator asks "who is your CISO?" and the honest answer is nobody — common on the road to SOC 2 or ISO 27001. The pre-scale startup: enough at stake to need adult supervision, not enough to attract a serious full-time executive. The interim gap: the CISO left and the search will take six months; a fractional leader keeps the program from drifting. The regulated small firm: frameworks like NYDFS Part 500 permit a third party to fulfil the CISO function, which is effectively a regulatory endorsement of the model for smaller covered entities — with oversight retained in-house.

Where does it fail?

Predictably. The accountability gap: contracts cap liability, and when a breach lands, the company — not the consultant — answers to customers and regulators. A vCISO transfers work, not risk. The operator mismatch: a company in active incident-response chaos needs hands, not a two-day-a-month strategist. The shelfware program: policies delivered, roadmap presented, nobody internal owns execution, and twelve months later nothing has changed but the audit binder. The stretched portfolio: a vCISO carrying too many clients gives each one the leftovers; asking how many concurrent engagements they run is a fair and revealing question.

How should a company buy one well?

Treat it as an executive hire, not a procurement line. Interview for industry scar tissue, demand references from companies your size, and put three things in the agreement: a named individual (not "our team"), explicit incident-response availability with response times, and a definition of done that includes an internal owner for every deliverable. Plan the exit from day one — the best fractional engagements end with a full-time hire the vCISO helped scope, or with a program an internal leader can run. If the pitch is a permanent subscription with no path to ownership, that's a product, not a CISO.