By Jayson Conley | September 25, 2026
You have three proposals in front of you. One quotes $4,000 a month, one quotes $9,500, and one quotes $18,000. All three call themselves a virtual CISO engagement, and none of them explains the gap. That is the normal experience of pricing security leadership for the first time, and it is why vCISO cost is one of the harder line items to defend in a budget conversation.
The spread is real, and it usually is not padding. Two providers can quote the same company three times apart because they are selling genuinely different scopes, and neither proposal says so out loud. One is a quarterly advisory call. The other is someone who owns your compliance program and answers your customers’ questionnaires.
This guide gives you the market ranges, explains what moves a quote up or down, and walks through the costs that almost never appear in the retainer line: tooling, audits, penetration tests, and the labor to build what your roadmap recommends. It also covers how the total compares to a full-time hire and how to defend the spend to a board. Where a number cannot be pinned down honestly, this guide says so.
A vCISO, also called a virtual CISO or a fractional CISO, is a senior security executive who owns your security strategy, risk reporting, and compliance oversight part-time. The role is accountability, not hours. A vCISO decides which risks get addressed first, which framework genuinely applies, what spend is justified, and how all of it gets explained to your board and your customers.
That distinction matters when you read a proposal. You are not buying hours of consulting. You are buying judgment about where your money should go, and someone who will stand behind those decisions when an auditor or an enterprise prospect asks who owns the program. A consultant delivers a report. A vCISO carries the roadmap forward, adjusts it when your business changes, and absorbs the questions your COO is fielding today.
If you are still deciding whether the model fits your company at all, that case sits in our guide to the benefits of a vCISO. This guide assumes you want the function and now need to price it.
Three vCISO pricing models dominate the market: a monthly retainer, hourly or block-purchased advisory time, and fixed-fee projects. Most engagements use one as the base and borrow from the others when something unusual comes up. Published guides on virtual CISO cost and fractional CISO pricing describe the same three shapes, since the market uses those labels and vCISO interchangeably. Every figure below comes from those market sources rather than from Brightworks’ own rates.
Across the market, published provider guides place the vCISO monthly retainer between roughly $3,000 and $20,000 per month, with mid-market programs clustering between $5,000 and $12,000. Advisory-only engagements sit at the bottom of that band. Programs with active compliance management, board reporting, and hands-on roadmap execution sit at the top, and heavily regulated environments run past it.
The retainer fits when you need someone to own the program continuously. Security work does not arrive in tidy quarterly batches. Questionnaires land the week a deal is closing, and an auditor’s request list does not wait for your next scheduled call.
Market rates for a vCISO hourly rate commonly run $200 to $500 per hour, with the spread tracking the practitioner’s seniority and how specialized the work is. Rates at the top of that range typically reflect deep experience in a specific regulated vertical.
Hourly works well for narrow questions: a second opinion on an architecture, a review of a questionnaire you have drafted, or prep before a board meeting. It works poorly as a substitute for program ownership. When nobody is accountable between calls, the roadmap stalls and you pay premium rates for someone to re-learn your environment each time.
Scoped projects such as a risk assessment, a policy build, or an audit readiness push commonly run $5,000 to $50,000 and up, and complex first-time framework builds exceed that. vCISO project pricing gives you cost certainty, which helps when you are trying to get one specific thing approved and finished.
What a project does not do is replace ongoing leadership. A readiness project ends, but your controls still need monitoring, your evidence still needs collecting, and your next enterprise customer will still send a questionnaire. A common pattern is a project to build the program followed by a smaller retainer to run it.
Rough bands by headcount, for a first budget pass:
Headcount is a proxy, not a formula, and a weak one. A 60-person healthtech company handling protected health information under HIPAA with a SOC 2 commitment can require more work than a 400-person unregulated services firm. Ask any provider to map price to deliverables rather than to employee count.
Four vCISO cost drivers explain most of the variation in vCISO pricing. Once you can locate your own company against them, you can interrogate a quote instead of guessing.
Compliance scope and the number of overlapping frameworks. One framework is a project. Three is a program. SOC 2, HIPAA, CMMC, and ISO 27001 share underlying control work, but each carries its own evidence requirements, audit cadence, and auditor relationship. Every framework you add raises the management load more than the control work alone suggests.
Industry and regulatory exposure. Healthcare, financial services, and defense contracting price above unregulated industries at the same headcount. The work is more prescriptive, the documentation burden is heavier, and the consequences are enforced by a regulator rather than negotiated with a customer.
Practitioner seniority and whether you get a person or a team. A former enterprise CISO with fifteen years in your vertical costs more than a generalist, and often justifies it by reaching the right answer faster. Ask also whether you get one individual or a bench with in-house depth across security, compliance, and IT strategy. That affects price, and what happens when your one person is unavailable during an incident.
Whether the engagement advises or executes. This is the largest driver and the one most often left ambiguous. An advisory retainer produces a prioritized roadmap and leaves implementation to you. An execution-inclusive engagement builds the controls, configures the tooling, and closes the gaps. The price gap between those two is large, and so is the gap in what actually gets done. Ask directly: after this engagement recommends multi-factor authentication everywhere, who deploys it?
This is where standalone security budgets break. The retainer is the visible number, so it becomes the number in the budget, and then invoices start arriving from three other vendors. The hidden costs of a vCISO engagement are rarely hidden deliberately. They are just not the provider’s line items, so they do not appear in the proposal.
Here is what to budget alongside the retainer.
Required tool purchases commonly add $500 to $5,000 monthly, and governance, risk, and compliance platform subscriptions alone are commonly published at $10,000 to $50,000 per year depending on company size and framework count. Endpoint detection, logging, device management, and vulnerability scanning stack on top.
Some providers include GRC platform licensing in the engagement, and some require you to buy a specific platform as a condition of the work. Ask upfront, because the answer can move your first-year total by tens of thousands. Brightworks includes GRC platform licensing in its Tier 1 vCISO program, which is one reason comparing proposals is harder than comparing two monthly numbers.
In nearly every engagement, the audit is billed separately by the audit firm. A vCISO prepares your program and your evidence. Only a licensed CPA firm can issue a SOC 2 attestation report, and only an accredited body can certify ISO 27001. No security leader can promise a clean result, and any provider implying otherwise is selling something they cannot deliver.
A first SOC 2 Type 2 audit from a regional or boutique firm commonly runs $12,000 to $60,000 in audit fees, with all-in first-year program costs for mid-market companies commonly published at $60,000 to $150,000 once readiness work, tooling, and internal time are counted. Penetration tests commonly run $5,000 to $20,000. Type 2 costs more than Type 1 because it requires an observation period, typically three to twelve months, during which your controls have to actually operate and produce evidence.
Budget each as its own line, and if a proposal appears to include them, read the scope language twice.
A pure advisory retainer produces recommendations that someone still has to build. Somebody has to configure conditional access, roll out endpoint agents, rebuild the offboarding process, and remediate the penetration test findings.
If you have an internal IT team with capacity, that labor is already paid for and an advisory retainer may be exactly right. If you do not, the work becomes a separate engagement with a separate vendor at project rates. The retainer looked affordable. The implementation quote that followed did not.
The contract mechanics deserve a careful read: strict hour caps, the out-of-scope rate, whether an incident triggers premium billing, whether a mid-term tier upgrade sits at the provider’s discretion, the initial term, and the early termination fee.
Ask four questions before you sign. What is out of scope, in writing? What is the rate if we exceed the retainer? How does billing work during an active incident? What does it cost to leave at month seven?
How the total changes when the vCISO sits inside your existing team. Add it up and the pattern is clear: the advisory line item is often the smallest part of a security program’s real cost, and tooling, audits, testing, and implementation labor usually exceed it. That math changes when the vCISO works inside the organization already running your infrastructure. The roadmap goes to a team that can execute it rather than into a procurement cycle, tool decisions get made by the people who will administer them, and nobody bills you to learn your environment. Brightworks operates as a managed IT and cybersecurity provider first, so a vCISO engagement sits on top of an existing practice rather than beside a separate implementation vendor.
Market sources commonly place the fully loaded cost of a full-time CISO at $250,000 and up, with total packages frequently published at $250,000 to $400,000 once salary, bonus, equity, benefits, and payroll taxes are counted. Executive search fees add another 25% to 30% of first-year base if you use a recruiter.
Set that against an annualized retainer. A $9,000 per month engagement runs $108,000 per year. The vCISO vs full-time CISO cost comparison favors the fractional model by a wide margin for companies under roughly 500 employees, which is why the model exists.
Be careful about what the comparison proves. It is a cost comparison, not a scope comparison. A full-time CISO works on your company every day, sits in your leadership meetings, and is available the moment something breaks. A vCISO gives you senior judgment on a defined cadence. For most mid-market companies the fractional version is sufficient and the full-time version is unaffordable, which makes the decision easy. It does not make the two equivalent, and a provider who says otherwise is overselling.
Most published CISO compensation data is weighted toward coastal and enterprise employers. Compensation research consistently shows apex coastal metros pricing 15% to 25% above national medians for equivalent scope, while smaller Midwest and Southern markets commonly run 10% to 15% below.
If you are a Midwest company benchmarking against a national CISO salary figure, you may be pricing your local market against a number built largely from New York, Boston, and Bay Area packages. The same effect applies to provider rates. Brightworks is based in Carmel, Indiana, and works across healthcare, financial services, manufacturing, and professional services, which is a different cost structure than a coastal firm serving the same verticals. Ask where a provider’s comparison data comes from before accepting a savings claim built on it.
Start by discarding the argument you will be handed most often. Nearly every page on this topic quotes an average breach cost figure, usually in the millions, and implies it applies to your company. It does not. Those averages are dominated by large enterprises and heavily regulated data breaches, and applying a global mean to a 150-person firm is not analysis. Any provider quoting you a payback period is guessing, and the honest position is that virtual CISO ROI is judgment applied to real decisions rather than a percentage.
Three lines of reasoning hold up in a board meeting, because each uses numbers you already have.
This is usually the strongest case. If enterprise deals are stalling behind security questionnaires, you already know the value of those deals and how long they have been stuck. Audit-ready documentation and a named owner for security shorten diligence, and the arithmetic is specific to your pipeline rather than borrowed from a study. Pull the deals held in security review, total the contract value, and estimate the delay. That number is defensible because you generated it, and it typically dwarfs the retainer.
Your COO or VP of Engineering is already doing part of this job. Count the monthly hours going into questionnaires, vendor security reviews, policy questions, and audit preparation, then apply a fully loaded cost to them.
That cost is already being paid. It is invisible, showing up as delayed hiring and postponed operational work rather than as an invoice. Making it visible is often what moves a skeptical CFO, because it reframes the retainer as a reallocation rather than a new expense.
The solo-practitioner model dominates this market, and it carries a specific risk: your program history lives in one person’s head. If that person takes a full-time role, gets sick, or gets busy with a larger client, your institutional knowledge walks out with them and you pay again to rebuild context you already bought once.
A team-backed model spreads that knowledge across a bench and a documented program, and it tends to produce more consistent service. Brightworks holds a 92% client retention rate, resolves tickets in an average of 3.1 hours, and runs 0.43 tickets per endpoint per month. Those are operational numbers rather than security outcomes, but they speak to whether a provider stays and delivers consistently, which is what continuity depends on.
No provider can give you a real number from a website. What they can do is scope the work, and a good scoping conversation covers four things.
Your current posture. What controls and documentation exist, and where the gaps are. A provider who quotes before understanding this is pricing a guess.
Which frameworks genuinely apply. Not which ones sound reassuring. If your customers ask for SOC 2 and nobody has mentioned ISO 27001, scoping both spends money on a hypothetical.
What your existing IT team can execute. This decides whether you need advisory or execution, the largest single factor in your total.
What sits inside the engagement and what sits outside. Tooling, audit fees, penetration testing, and implementation labor, each answered explicitly.
Brightworks structures vCISO work across three tiers, from the vCISO Cyber Advisory Program through Security Program Management to Full vCISO Leadership Services, each with a published deliverable list so you can see what scope maps to what level of engagement. Review the tiers on the Virtual CISO Services page, or get started with a scoping conversation about which one fits.
Whatever you decide, ask every finalist for the same three views: the one-time build cost, the steady-state monthly retainer, and the realistic first-year total including audits and tooling. A provider who will not give you all three is asking you to sign for a number that is not the real one.
Is an hourly vCISO cheaper than a monthly retainer? For small, bounded work, yes. Hourly engagements cost less than a retainer if you only need a few hours of senior review. The economics reverse once the work becomes continuous, because nobody owns the program between calls and you pay premium rates for context a retained provider would already have.
Why do two vCISO quotes for the same company differ by three times? Almost always because they are quoting different scopes. One is advisory: strategy, quarterly reviews, and a roadmap. The other includes execution, compliance management, and incident response leadership. Ask both providers for a deliverable list rather than a price, and the gap usually explains itself.
When is a vCISO the wrong purchase for a business? When you have no compliance obligation, no enterprise customers asking security questions, and no internal capacity to act on a roadmap. A vCISO produces decisions and priorities, and if nobody can execute them, you are buying a document. Managed security services and a competent IT provider are the better first purchase.
Should you buy a one-time compliance readiness project instead of an ongoing retainer? A project makes sense when you have one specific deadline, such as a customer demanding a SOC 2 report, and an internal team that can maintain the program afterward. Compliance is not a one-time event: controls have to keep operating and evidence has to keep accumulating for renewals. Many companies buy the project first, then add a smaller retainer to sustain it.
Does year one cost more than the years that follow? Usually yes, and often by a wide margin. Year one carries the policy build, the initial risk assessment, remediation of existing gaps, first-time tooling purchases, and the first audit. Published guidance commonly places renewal audit fees well below first-year fees, and steady-state years settle into retainer plus tooling plus the recurring audit.
What questions should you ask to compare two vCISO proposals fairly? Ask each provider for the same five things: a written deliverable list, what is explicitly out of scope, whether GRC platform licensing is included, who performs implementation work, and the total first-year cost including audits and tooling. Then ask about term length, overage rates, and exit terms. Proposals that look three times apart on the monthly number often land closer once that is on the table.
"*" indicates required fields
Brightworks
Brightworks