Context: The Questions Nobody Answers Clearly
You're building your budget and need security leadership. You've heard about vCISO services, so you start asking around. The answers you get are vague: "It depends." "What's your scope?" "Let's schedule a discovery call."
What you really want to know is: What should I expect to pay, what will I get for that money, and how do I know if I'm overpaying or buying something ineffective?
These are the questions I hear constantly from risk officers, CFOs, and board members evaluating vCISO engagements. Here's what you need to know before you sign anything.
Why Does vCISO Pricing Vary So Much?
You're not buying a commodity. You're buying time, expertise, and accountability from someone who'll either build your security program or just show up for an hour a month.
The range runs from roughly $20,000 per year to over $350,000. That's not price gouging. It's the difference between a junior consultant checking boxes and a Fortune 500 CISO running your interim program during a crisis.
At $20,000 annually, you're spending about $1,600 per month. That buys you three to five hours of actual vCISO time. If they're any good, they're spending that time in your team meeting or producing one deliverable, not both. They're not building your vendor risk program, writing your incident response plan, or sitting in on your SOC 2 audit.
At $120,000 per year, you're getting a senior practitioner who knows your environment, attends your meetings, and actually moves your program forward week over week. That's the midmarket benchmark for quality work.
At $350,000, you're typically an enterprise dealing with a CISO departure, a regulatory incident, or a major M&A integration. You need someone who can step into a board meeting tomorrow and own a multi-entity global program with zero ramp time.
What's the Risk of Going with the Cheapest Option?
You get what you pay for, and what you don't pay for can come back to bite you.
The $20,000 vCISO often comes from a managed service provider's service menu. In practice, they're selling you the MSP's security tools. You ask about endpoint protection, they recommend the product they resell. That's not strategic leadership. That's a sales channel.
The other version is a fractional slice of someone's time so small they can't possibly know your business. They're managing 15 other clients. They don't know your infrastructure, your product, or your compliance obligations in any depth.
Here's the practical problem: coverage. Your security program works fine 47 weeks a year. Then week 48 hits. You're mid-audit. A critical vendor questionnaire lands. Your $20K vCISO is unreachable. You're on your own, and you don't have the expertise to answer the questions correctly.
If you're just checking a box for a procurement form, fine. If you're actually managing enterprise cyber risk, this doesn't work.
How Do I Know If I Need the $350K Version?
You probably don't. But if you do, you already know it.
The high-end engagements serve three scenarios:
Your full-time CISO just left, and you need program continuity while you run an executive search. Those searches take six months minimum. You can't go dark.
You had a serious incident or regulatory finding. You need someone who can rebuild credibility with your board, your regulators, or your customers while fixing what broke.
You're in the middle of a transaction. You're being acquired, you're acquiring someone else, or you're carving out a business unit. You need a CISO-level leader managing the security workstream alongside your integration team.
These situations require someone in the top 10% of practicing CISOs globally. They bill hourly at $300 to $600, or they work on retainer at $10,000 to $20,000 per month plus hourly for specific projects. They're putting in 20 to 25 hours some weeks. They're bringing additional team members when needed.
It's expensive because the alternative is worse. You can't afford to get this wrong.
Can I Just Hire Someone Hourly When I Need Them?
You can try. It usually doesn't work.
Ten hours a month is 1/16th of someone's working time. That's not enough time to internalize your environment, understand your business model, or produce meaningful progress on your program.
There's also a capacity limit. A good CISO can effectively manage two to four clients, depending on engagement depth. Beyond that, they don't know your details well enough to provide strategic value. If someone's juggling 15 clients at 10 hours each, they're not doing CISO work. They're doing triage.
Security program maturity requires continuity. You need someone who remembers what you discussed last month, knows what's due next quarter, and understands how your vendor risk program connects to your SOC 2 scope.
Hourly-as-needed engagements work for very specific tactical projects. They don't work for ongoing security governance.
What Should a Midmarket Company Actually Budget?
Around $120,000 per year for a quality engagement.
That assumes you're a midmarket company with reasonably normal complexity. You're not a 35-person SaaS startup with one cloud environment. You're not a 400-person healthtech company selling connected medical devices across hybrid infrastructure.
At that price point, you should get a senior practitioner who shows up to your meetings, knows your business, and delivers guidance specific to your environment. You should get backstop coverage so you're not exposed when they're unavailable. You should get real deliverables that move your program forward, not generic templates.
The cost may come down once your program matures. It's less work to operate an established program than to build one from scratch. You'll know you're there when you're running quarterly internal audits, executing annual tabletop exercises, managing vendor onboarding and offboarding consistently, and actually fixing the findings from your penetration tests.
But you won't start at steady-state pricing. Building the program is the expensive part.
How Do I Measure If It's Worth It?
Compare the cost to your alternative scenarios.
The average ransomware recovery for a small business now runs well into six figures. That's before you count the customer trust you lose, the contracts you don't renew, and the regulatory scrutiny you invite.
A quality vCISO engagement costs less than one serious incident. But only if they're actually building a program that prevents incidents, not just filling out questionnaires.
Ask specific questions during evaluation: Who exactly will be working on our account? How many other clients do they manage? What happens when they're unavailable? What deliverables will we see in the first 90 days? How do you handle coverage during audits or incidents?
If the answers are vague, you're buying the cheap version. If they're specific and tied to your environment, you're buying something real.
Where to Go From Here
Start by defining what you actually need. If you're building a program from scratch, you need more than a few hours a month. If you're maintaining something mature, you need less. If you're in crisis, you need someone who can start tomorrow.
Then budget accordingly. Cheap vCISO services exist because some companies only need cheap vCISO services. Just be honest about which company you are.
If you're managing real enterprise cyber risk, plan to spend what it costs to do it right. The alternative is more expensive.
