vCISO Cost Guide: What a Virtual CISO Really Costs

Company size is a rough proxy for price because it tracks the real drivers: the number of systems, the data you hold and the obligations your customers put on you. The table below combines published provider benchmarks from 2026. Most of them are US figures in US dollars.

Our opinion, which some providers will dispute: below roughly $2,000 a month you are not buying security leadership. You are buying templates and a monthly call. That can be the right purchase at pre-seed. Just do not expect it to survive enterprise due diligence.

The pricing model matters as much as the number. Each one fails in a predictable way.

For most SaaS companies with a real deadline, a retainer is the right structure. For a company that only needs to know where it stands, a fixed project first and a retainer later is usually cheaper.

Across our engagements, the same seven factors decide where a quote lands. Company size explains less than people expect.

The comparison most pricing pages make is flattering and incomplete, so here is the honest version.

The IANS and Artico Search compensation survey of small and mid-market companies, those with up to $1 billion in revenue, found that CISOs there earn an average of $415,000 in total compensation. Our own ROI model uses a more conservative $250,000 salary baseline before benefits and equity, and we price fractional work at $200 an hour across roughly 10 to 60 hours a month.

At 30 hours a month, that is $6,000 a month or $72,000 a year. Against a $250,000 salary that looks like a large saving, and it is. But it is not a like for like comparison. You are buying 30 hours, not 160. What you save is the cost of senior leadership for the weeks when you do not need it.

The fair question is not "which is cheaper". It is "how many hours of senior security judgement does this company need each month right now?" If the honest answer is more than about 100, hire.

Most providers hide their pricing. Ours is published on our pricing page, and the tiers below are the live figures at the time of writing.

If these figures change, the pricing page is the source of truth, not this post.

This is where budgets go wrong. A vCISO designs and runs the programme. They do not pay for it. Plan separately for:

Ask every provider whether they earn referral fees on the tools they recommend. There is a defensible answer to that question. "No conflict at all" is rarely it.

We turn work away for these reasons, and you should keep your money in these situations:

Money spent in the wrong order is the most common waste we see. This is the sequence we use, with the hours we typically need for a 30 to 200 person SaaS company.

By day 90 you should know your annual security budget within a reasonable range. If a provider cannot tell you that, the engagement is drifting.

The IBM Cost of a Data Breach Report 2026 puts the global average cost of a breach at $4.99 million, a record high. Organisations that made extensive use of AI and automation in security saved $1.93 million compared with those that used none. IBM also reports that close to seven in ten breached organisations had no policy for governing AI.

A fair caveat: the IBM study skews towards larger organisations, and a breach at a 40 person company usually costs less in direct terms. The costs smaller companies feel first are different: the enterprise deal that stalls for a quarter, the diligence finding that lowers a valuation, the customer who does not renew. A $72,000 year of fractional leadership is roughly 1.4% of IBM's global average breach. It is also, more practically, often less than one delayed enterprise contract.

Put the quotes side by side and ask each provider the same questions:

The cheaper quote with a named senior practitioner usually beats the more expensive one staffed by whoever is free that week.

If you want to see where you stand before talking to anyone, our free self-serve assessments return a prioritised remediation roadmap without a sales call, including a cybersecurity baseline assessment. The live tiers are on our pricing page, and you can read how our virtual CISO services and fractional CISO services differ.

If a certification is the trigger, start with SOC 2 compliance, ISO 27001 consulting or, if you ship AI features, ISO 42001 consulting. Defence suppliers should read our CMMC compliance page. For background on the role itself, see what a virtual CISO actually does and our comparison of a full-time CISO vs a virtual or fractional CISO.

If you would rather talk it through, including whether you need a vCISO at all, book a call.