What Makes a Great vCISO?

Ask any vCISO what makes them different and you'll hear the same six things, in the same order, almost every time. CISSP or CISM. Prior CISO roles. Fluency in NIST, ISO 27001, whatever framework your auditor is holding this quarter. A board deck that looks the part. References from companies your size. A rate that looks reasonable next to a full-time hire. Ask them anyway, in writing, before you sign anything. They're still worth asking. They just don't sort the field the way people think they do.

Here's why. A full-time CISO now runs $150,000 to well over $400,000 depending on the market. A fractional one comes in sixty to seventy-five percent cheaper.

That gap is the whole business model, and it's also why "vCISO" has stretched across a range wide enough to mean almost nothing. Eight hours a month and forty hours a month get the same title. $150 an hour and $650 an hour get the same title. Same certification, same day rate, completely different job.

The gap doesn't show up in the engagement letter. It shows up nine months in, when something breaks and the board asks who's actually accountable — and nobody on the org chart has a clean answer.

The checklist gets you to average

Growth did this. The vCISO market is somewhere around a billion to a billion and a half dollars as of 2024, and forecasts have it growing six to fifteen percent a year into the next decade. Two forces are pushing that: companies that will never justify a full-time CISO, and a regulatory climate that's made not having security leadership look reckless. Growth that fast pulls in supply fast. Supply that fast is never evenly good.

None of that makes fractional the problem. Let me argue against my own drift for a paragraph, because the honest version is more useful than the tidy one. Most mid-market companies were never hiring a $300,000 CISO. The real alternative to a good vCISO isn't a great in-house one — it's no security leadership at all, or an IT manager wearing a title nobody trained them for. A well-run fractional arrangement usually beats that. The failure isn't the arrangement. It's assuming the title still carries the accountability the arrangement was built to avoid.

Where the difference actually lives

There's a rule now, and it has teeth. The SEC's cyber disclosure rule, live since September 2023, gives public companies four business days to report a material incident. Four days turned "who decides what's material" from a policy question into a personal one. Uber's CISO was criminally convicted for covering one up. SolarWinds' CFO and CISO both got SEC civil notices over Sunburst. Proofpoint surveyed 1,600 CISOs across sixteen countries in 2025 and found roughly a third whose organization has done nothing to protect them from personal liability. A third. Nothing.

A good vCISO has already worked out where they sit in that picture, and they'll tell you straight. Do they carry E&O or D&O coverage sized to the actual risk — and will they show it to you. Are they the name in your incident response plan who signs off on materiality, or does that sit quietly with someone on your side reading language the vCISO drafted. Do they present to your board directly, on a real cadence, or does everything filter through one internal contact who may or may not be passing it along straight. A vCISO who's happy to advise but never the accountable party is selling you half the job. The strategy half. Not the part that makes a CISO a CISO — being the name on the line when the clock starts.

The hours matter more than people admit at signing. Eight hours a month is fine in a quiet quarter. It was never built for the week an incident eats all of it and asks for more. Ask what happens then. Whether the hours flex, at what rate, how fast.

What I would do about it

Get the hours in writing, and get a specific answer for the month an incident burns through them. A vague answer here is the answer.

Ask for the E&O or D&O policy, sized to your risk, and ask to see it. A provider who's actually taking on the accountability has already priced it into the rate.

Get a name for who signs the materiality call and drafts the disclosure language — or the breach notice, if you're not public. Not a department. A name.

Ask what the reporting line really looks like. Direct to the board on a set cadence, or funneled through one person who decides what gets passed up.

Ask what happens to the program the day the engagement ends. A good vCISO leaves documentation your next hire can pick up cold. A weaker one leaves with most of it still in their head.

A great vCISO isn't the one with the sharpest deck on the first call. Plenty of average ones have learned to build one of those. A great vCISO is the one still on the call at 2 a.m., nine months into a bad year, willing to be the name on the report — not the strategist who was always going to be one door down from the part that actually costs something.

Sources

*BlueRadius, Virtual CISO Market Report (2025), on market size, growth, and retainer/pricing data; Proofpoint, 2025 Voice of the CISO Report (1,600 CISOs, 16 countries, Q1 2025), on CISO personal-liability protection; Cybersecurity Dive reporting on SEC cyber disclosure rules and CISO liability, including the Uber and SolarWinds enforcement cases. Figures reflect public reporting available as of mid-2026.*

A great vCISO isn't the one with the sharpest deck on the first call. It's the one still on the call at 2 a.m., nine months into a bad year, willing to be the name on the report.