A 240-person software company gets a security questionnaire from a retail customer that wants a named security leader and evidence of an annual tabletop exercise. The company has a capable IT manager and an outsourced monitoring provider, but nobody who owns security strategy. The CFO asks what a fractional leader would cost, and the answers range from $3,000 a month to $25,000 a month. Both numbers are accurate, and neither tells her what she’ll actually pay.
This guide builds the price from the ground up. The figures come from 3 vendor-published pages: BD Emerson’s cost article (published July 10, 2026), Side Channel’s pricing guide and Consilien’s pricing article, which discloses that Consilien sells the service. They’re vendor estimates, not independent surveys, so treat them as ranges to test in quotes. The annual scenarios are my illustrative assumptions, labeled as such. Confirm every price and contract term with the vendor you’re evaluating.
TL;DR
- The monthly price is driven by days and scope. BD Emerson puts vCISO retainers at $3,000 to $25,000 a month, and Side Channel and Consilien both land near $3,000 to $20,000. Company size is the strongest predictor: a 200 to 500 person company usually sees $5,000 to $12,000 monthly, or $60,000 to $144,000 a year before extras.
- The retainer isn’t the whole bill. Tools ($500 to 5,000amonth),overagehours(250 to 400anhour),penetrationtestsandaudits(10,000 to $50,000 or more) and implementation labor sit outside most retainers. In my 3 illustrative scenarios, the retainer is only 64% to 89% of total annual spend.
- Fractional usually beats a full-time hire below roughly 500 to 1,000 employees. BD Emerson prices a loaded full-time CISO at $250,000 to $400,000 or more, plus a recruiter fee of 25% to 30%. Once fractional spend nears $180,000 to $220,000 a year, it’s worth pricing a hire.
What a fractional security leader is paid to do
A vCISO is a part-time executive who owns the security program’s direction rather than its daily operation. That means setting the risk register, deciding which controls matter this year, owning the policy set and answering for security in front of customers and auditors. A monitoring provider watches alerts, and an IT manager keeps systems running. The vCISO decides what gets prioritized and funded, which is why companies hire a vCISO when a deal or an audit demands a named accountable person.
The role differs from a consultant in a single important way: continuity. A consultant delivers a report and leaves, while a vCISO holds a standing seat and carries decisions from quarter to quarter. BD Emerson describes its Embedded tier as covering weekly leadership meetings, management of internal staff and the managed security provider, budget ownership and incident command. That’s a job description, and it’s priced like a job. The value is senior judgment about what to skip, which is why the same title spans an $18,000 annual engagement and a $240,000 engagement.
Monthly retainer tiers by days per month
BD Emerson organizes its pricing by how many days of leadership you get each month, which is the cleanest way to compare quotes because days are a unit you can verify. The table reproduces its 3 tiers, with annual cost calculated by multiplying the monthly range by 12. These are the vendor’s published ranges rather than market averages, and the Embedded tier is listed as “$25,000 and up,” so treat $25,000 as a floor for the top end. The same source quotes a blended day rate of $1,200 to $2,500.
| Tier | Days per month | Monthly price | Annual cost (calculated) | Fit per BD Emerson |
| Advisory | 1 to 2 | $3,000 to $6,000 | $36,000 to $72,000 | Under about 100 employees, light compliance load |
| Operational | 4 to 6 | $8,000 to $16,000 | $96,000 to $192,000 | Companies holding or pursuing SOC 2 or ISO 27001 |
| Embedded | 8 to 12 | $15,000 to $25,000 and up | $180,000 to $300,000 and up | Bridge to a full-time hire or a high-stakes period |
What each tier should include
Advisory tier. BD Emerson says this level should cover a quarterly risk review, ownership of the policy set, a board-readable quarterly report and an executive point of contact for urgent decisions. It’s built for a company with fewer than about 100 employees and a light compliance load. The vCISO doesn’t run your program day to day, and you shouldn’t expect weekly calls. What you get is a credible named owner and a rhythm of review, which is often enough to satisfy a customer questionnaire.
Operational tier. This tier adds risk register management, vendor security reviews, ownership of questionnaires and audits, an annual tabletop exercise and monthly metrics, according to the same source. At 4 to 6 days a month, the vCISO is a regular presence in your planning. It’s the tier most companies with an active SOC 2 or ISO 27001 effort land in, because audit evidence needs someone chasing owners every month. The tradeoff is cost: make sure your team has capacity to act on the advice.
Embedded tier. At 8 to 12 days a month, the vCISO attends weekly leadership meetings, manages internal security staff and the managed security provider, owns the budget and commands incidents. It also covers board conversations and M&A diligence. This is close to half-time work. BD Emerson frames it as a bridge to a full-time hire or cover for a high-stakes period, such as an acquisition, and the price reflects that: $180,000 to $300,000 a year before extras.
What the price-band view adds. Side Channel describes a similar ladder by price band instead of days. Its $1,500 to $4,000 band covers an initial risk assessment and gap analysis, 5 to 10 core policies, monthly strategic calls and questionnaire support for a single framework. Its $8,000 to $20,000 band adds board presentations, multi-framework compliance, M&A due diligence, cyber insurance review and on-call incident availability. Use either ladder as a checklist when you read a proposal.
Factors that push the price up or down
Every source agrees that scope moves the price more than anything else, but they list the drivers differently. Pulling them together gives a working list of what to disclose before you ask for quotes, because each of these changes the number a vendor will return. If you hide an audit date or a regulatory obligation, you’ll usually find it later as an overage invoice or a change order. The 4 drivers below carry the most weight.
- Company size and industry. Side Channel states that company size is the single strongest predictor of what you’ll pay, with bands rising from $1,500 to $4,000 a month for startups of up to 50 people to $10,000 to $20,000 for companies of 500 to 1,000. Healthcare, financial services and defense contracting carry a premium on top, according to BD Emerson and Side Channel, because a mistake costs more and the regulator asks harder questions.
- Number of frameworks and audit timing. Running SOC 2 and HIPAA at the same time multiplies the mapping and evidence work, and an audit window compresses it into a few months. Side Channel lists concurrent frameworks, active audits and SOC 2 pursuit as separate drivers. Tell vendors which frameworks you expect to pursue in the next 18 months, so the quote doesn’t need rewriting at renewal when the second audit starts.
- Hands-on work and incident readiness. A vCISO who writes policies and answers questionnaires personally costs more than a vCISO who reviews work your team produced, and Side Channel lists hands-on versus advisory-only as a distinct driver. On-call availability adds cost too. BD Emerson quotes incident surge work at $250 to $500 an hour, or premium day rates above the retainer. Decide which model you need before requesting quotes, because a quote for advice alone will look cheap next to a quote for hands-on delivery.
- Seniority and bench. A former CISO with 20 years of experience prices above a consultant with 6, and a firm with specialists behind the named lead prices above a solo practitioner. The bench matters when your lead is on vacation or when you need a cloud security opinion outside their expertise. BD Emerson also notes that geography matters less than it used to, though an on-site expectation for incidents adds cost.
Hours per month and the implied hourly rate
Side Channel and Consilien publish near-identical price bands by company size, and Consilien adds an hours column. Combining them lets you calculate what an hour of retainer time costs, a number vendors rarely volunteer. The implied rate column is my arithmetic: the low price divided by the low hours, and the high price divided by the high hours. It assumes you use the full allotment, so your effective rate climbs in any month you don’t.
| Company profile | Monthly price | Hours per month (Consilien) | Implied rate per hour (my arithmetic) |
| Under 50 people, light compliance | $1,500 to $4,000 | 5 to 8 | $300 to $500 |
| 50 to 200 people, first framework | $3,000 to $7,000 | 8 to 15 | $375 to $467 |
| 200 to 500 people, active audit | $5,000 to $12,000 | 10 to 20 | $500 to $600 |
| Regulated or multiple frameworks | $10,000 to $20,000 | 20 or more | About $500 at 20 hours |
Larger companies pay for more hours and a higher effective rate. Vendor ranges also blur at the edges: Side Channel’s intro says mid-market companies of 100 to 500 employees pay $3,000 to $12,000 a month, while its table lists $5,000 to $12,000 for 200 to 500, and Consilien says most California mid-market companies pay $5,000 to $12,000. Use the bands to frame a conversation, then insist on a written scope and a stated hour count.
Why day rates, hourly rates and retainers don’t line up
Vendors quote 3 prices that rarely reconcile. BD Emerson cites a blended day rate of $1,200 to $2,500, Side Channel and Consilien cite hourly advisory work at $200 to $400, and the implied retainer rate from the table above runs about $300 to $600 an hour. Taken at face value, a 10-hour month at the hourly rate would cost $2,000 to $4,000, yet Consilien’s 200 to 500 person band starts at $5,000 for 10 hours. Dividing the Embedded tier’s monthly price by its days gives $1,250 to $3,125 a day, which sits at or above the blended day rate.
The gap isn’t necessarily a rip-off. Consilien describes hourly advisory as carrying no guaranteed availability or continuity, while a retainer reserves a named person’s time and gives you priority access. You’re paying for a standing commitment, much as you’d pay more for a reserved parking space than for a metered space. The practical question is whether the hours are a cap or a floor. Ask for the monthly hour count, whether unused hours roll over and what overage costs, since BD Emerson’s tiers give days but Side Channel gives no retainer hours.
Costs that sit outside the retainer
Tools and platforms. Required GRC platforms, SIEM tools or similar software run $500 to $5,000 a month, according to both Side Channel and Consilien, if the provider requires them. Over a year that’s $6,000 to $60,000. BD Emerson adds a warning worth heeding: vendors that resell the tools they recommend have a conflict of interest, so ask whether the vCISO earns a margin on the software they tell you to buy.
Overage hours and exit fees. Time beyond the monthly allotment is billed at $250 to $400 an hour, per both sources, so a 12-hour month on a 10-hour retainer costs an extra $500 to $800. An audit season can push that into thousands of dollars. Side Channel also reports early termination penalties of 2 to 3 months’ fees on 12 to 24 month contracts, which is $12,000 to $36,000 at $6,000 to $12,000 a month. Read the exit clause before you sign.
Testing and audits. Penetration tests, formal audits and vulnerability assessments typically cost $10,000 to $50,000 or more and are billed separately. The vCISO coordinates these but doesn’t perform them, and an independent auditor must be independent anyway. Budget this line explicitly if you’re pursuing SOC 2, since the report itself is an auditor’s work product, not a consulting deliverable. Ask whether the vendor will manage the auditor relationship and the evidence requests.
Implementation labor. If you lack internal IT staff to execute the roadmap, Side Channel and Consilien estimate contractors at $2,000 to $10,000 a month. A vCISO sets direction, but somebody has to configure single sign-on and chase access reviews. Without that labor, the roadmap sits unfinished and the retainer buys advice nobody acts on. Confirm whether your own team can absorb that work before you accept a low retainer, and price the contractor line if it can’t.
Annual cost scenarios
To show how the pieces combine, here are 3 scenarios built from the published ranges. Every assumption is mine and illustrative: I picked points inside the vendors’ bands, so your numbers will differ. Scenario 1 is an 80-person company with light compliance on an Advisory-level retainer. Scenario 2 is a 300-person company pursuing SOC 2 on an Operational-level retainer. Scenario 3 is an 800-person regulated company on an Embedded-level retainer.
| Line item (illustrative) | Scenario 1 (80 staff) | Scenario 2 (300 staff) | Scenario 3 (800 staff, regulated) |
| Monthly retainer | $4,000 | $8,000 | $15,000 |
| Annual retainer | $48,000 | $96,000 | $180,000 |
| Tools ($500 to $3,000 a month) | $6,000 | $18,000 | $36,000 |
| Penetration test or audit support | $0 | $25,000 | $40,000 |
| Implementation contractor | $0 | $0 | $24,000 |
| Total annual spend | $54,000 | $139,000 | $280,000 |
| Retainer as share of total | 89% | 69% | 64% |
The retainer shrinks as a share of spend as complexity rises, because tools and testing scale faster than the leadership fee. Tools climb from $500 a month in Scenario 1 to $3,000 in Scenario 3. Testing is $25,000 in Scenario 2 and $40,000 in Scenario 3, and Scenario 3 adds a $4,000 monthly contractor for 6 months. Change any input and the total moves. The takeaway is to budget 1.1 to 1.6 times the retainer, not the retainer alone.
How full-time CISO cost builds up
- Base salary. BD Emerson puts base pay for experienced CISOs at $200,000 to $300,000 in most US metros, and higher in coastal hubs. This is the number most people anchor on, and it’s the smallest piece of the story. A security leader in a high-cost market can push well beyond the upper bound, so check local salary surveys before assuming your region matches the range, and treat the figure as a floor for planning.
- Variable pay and benefits. The same source adds 20% to 30% of base for variable pay and benefits. On a $200,000 base that’s $40,000 to $60,000, and on a $300,000 base it’s $60,000 to $90,000. Applying the percentage at both ends of the salary range gives a loaded cost of $240,000 to $390,000, consistent with the article’s $250,000 to $400,000 or more. That loaded figure is the number to compare against a retainer.
- Recruiter fee. Recruiters charge 25% to 30% of first-year compensation, per BD Emerson. On $240,000 of first-year pay that’s $60,000 to $72,000, and on $390,000 it’s $97,500 to $117,000. Some companies hire directly to avoid the fee, but then they absorb the time a search consumes, which falls on your CEO, your HR lead and whichever executives sit through interviews. Either way, the cost lands in year 1, and it’s easy to leave out of a quick comparison against a monthly retainer.
- Search time and tenure. BD Emerson estimates 4 to 6 months to find and land a CISO. During that window you either have no leader or you pay an interim, and the fractional retainer you’d have bought is exactly that interim. The same article cites median CISO tenure of about 2 years and treats recruiting as a recurring cost, so the fee and the search can repeat every 24 months or so. A fractional contract has its own succession risk when the vendor’s lead changes.
Fractional versus full-time CISO, side by side
The cost difference gets the attention, but it isn’t the only difference. A full-time CISO gives you depth and institutional memory, while a fractional leader gives you breadth and speed. The table compares the 2 options on the criteria that usually decide the question, using BD Emerson’s and Side Channel’s figures where they exist and my own reading where they don’t, which I’ve marked. Treat the fractional start time as an estimate to confirm with each vendor.
| Criterion | Fractional vCISO | Full-time CISO |
| Annual cost | $36,000 to $300,000 and up, depending on tier | $250,000 to $400,000 or more, loaded (BD Emerson) |
| Time to start | Weeks (my estimate; confirm with vendor) | 4 to 6 months to hire (BD Emerson) |
| Weekly availability | 5 to 8 hours a month at the low end to about 12 days a month at the high end | 40 hours a week (Side Channel) |
| Typical need under 1,000 employees | Matches the 10 to 15 hours a week many companies need (Side Channel) | Often more capacity than the work requires |
| Recruiting cost | None | 25% to 30% of first-year pay |
| Continuity risk | Depends on vendor bench and contract | Median tenure about 2 years |
| Best fit | Under about 500 employees; bridging periods | Over about 1,000 employees; heavy regulation |
BD Emerson says fractional engagements cost 10% to 40% of the loaded full-time cost. Applied to its $250,000 to $400,000 range, that’s $25,000 to $160,000 a year. Its own Embedded tier, at $180,000 to $300,000, exceeds that band, so the 10% to 40% claim describes the lower tiers better than the top tier. That’s a useful reminder to compare like with like, and to ask any vendor quoting a savings percentage which tier the percentage assumes.
When fractional spend should flip to a hire
The switching point isn’t a single number, but the sources give a few markers. BD Emerson says fractional spend approaching $180,000 to $220,000 a year signals it’s time to consider a full-time hire, and describes fractional as how most companies under about 1,000 employees buy security leadership. Side Channel puts the 1,000-plus tier at $15,000 a month or more, or a full-time CISO, for $180,000 or more a year. Hours are the other marker. Side Channel observes that many companies under 1,000 employees need 10 to 15 hours of security leadership a week, which is 43 to 65 hours a month.
Consilien’s retainer for a 200 to 500 person company with an active audit offers 10 to 20 hours a month. If your real workload sits near Side Channel’s range and your retainer sits near Consilien’s, you’re either underserved or paying overages, and that mismatch is a stronger signal than any headcount threshold. A hire doesn’t automatically save money either. In my Scenario 3, the retainer alone is $180,000 against a loaded CISO of roughly $350,000 (assuming a $280,000 base and a 25% load, both illustrative), so fractional still costs about half. The hire adds a first-year recruiter fee of about $96,250, though. A 12-month fractional bridge during the search is a common middle path.
Contract terms to check before you sign
Hour allotment and rollover. State the monthly hours or days in writing, whether unused time rolls over and how overage is approved before it’s billed. Vendors that sell on availability without a number leave themselves room to under-deliver. If the contract says “up to” 10 hours, your effective hourly rate climbs whenever the vendor delivers less, and you’ll have little recourse unless a minimum is stated. Ask for a monthly usage report attached to each invoice, and have counsel review the final wording.
Named lead and bench. Put the named vCISO in the contract, and require notice and your approval if they’re replaced. Ask who covers when they’re unavailable and what that person’s experience is. A senior name in the sales meeting with a junior doing the work is a common pattern, and the contract is where you prevent it. Also ask for the lead’s current client count, since BD Emerson and Side Channel both warn that more than 8 to 10 clients thins attention.
Documentation ownership. Side Channel recommends confirming in writing that you own all documentation when the engagement ends. Policies, risk registers and evidence should transfer to you without a fee. If the vendor stores them in its own platform, ask for an export right and test it during the engagement rather than at termination, when you’ll have the least bargaining power and the most urgency. A clean handoff is also what makes switching vendors or hiring in-house practical.
Term and scope. Side Channel reports 12 to 24 month contracts with early termination penalties of 2 to 3 months’ fees. A first-year commitment is reasonable because a program takes time to build, but longer terms should come with an exit for cause, such as missed deliverables or a change of lead. List what’s in, what’s out and what triggers a change order, and require the vCISO to disclose any financial interest in software they recommend.
Red flags on the vendor side
- Too many clients behind a single name. BD Emerson and Side Channel both say more than roughly 8 to 10 clients per named vCISO thins attention. A leader who splits 40 hours across 12 clients can’t give any of them the 10 to 15 hours a week that Side Channel says many mid-sized companies need. Ask for the count, ask how it changed in the past year, and ask what share of the work the named lead performs personally rather than delegates.
- Reselling the tools they recommend. BD Emerson calls out the conflict of interest when a vendor resells the software it advises you to buy. A recommendation backed by a margin isn’t neutral. Side Channel’s middle tier lists vendor-neutral tool recommendations, so ask whether the vendor will state in writing that it earns no commission or referral fee on anything it tells you to purchase. A clear no is a good sign, and a hedge deserves a follow-up.
- No hour count or dated deliverables. A quote that promises “ongoing strategic support” without a number can’t be compared with anything, and it can’t be enforced. Ask for monthly hours or days and for named outputs with dates, such as a risk register by month 2 and a board report every quarter. Without dates, you can’t tell at month 9 whether you’re behind, and by then you’ve spent most of a year’s fees.
- Pricing that ignores your scope. If a vendor quotes the same number before and after hearing about your audit date and your regulators, it hasn’t priced your situation. Side Channel lists active audits and multi-cloud environments as price drivers, so a quote that doesn’t move with them is generic. Also be wary of a very low price attached to a senior name, because the hours have to come from somewhere.
Questions to ask on the first call
The first call should test pricing and delivery together. Vendors answer well-prepared questions concisely and tend to dodge the rest. The table pairs each question with what a strong answer sounds like and what should worry you. Use it as a script, take notes, and compare the answers across at least 3 vendors before you decide, since the variance between them is where the savings sit. Then take the answers to your finance lead and legal counsel before signing anything.
| Question | What a good answer sounds like | What should worry you |
| How many hours or days do I get each month? | A specific number, a rollover rule and a monthly usage report | “As much as you need” or “it varies” |
| How many clients does my named vCISO have? | A count under about 8 to 10 and an explanation of how time is split | A refusal to answer, or a number above 10 |
| What’s excluded from the retainer? | A line-by-line list of tools and testing, with prices | “Everything’s included” without a written scope |
| Do you earn money on any tool you recommend? | A clear no, or a disclosed referral fee you can see in writing | A hedged answer or a bundled platform fee |
| Who owns the documents if we leave? | You do, with an export right and no fee | Documents locked in the vendor’s platform |
| What happens if my vCISO leaves? | A named backup, notice to you and a transition plan | “We’d find someone” with no timeline |
How to tell whether you’re getting value
Value from a vCISO shows up in outputs you can count, not in a feeling of reassurance. Set measures in the first 30 days, review them at 90 days and decide at 6 months whether the engagement is on track. Start with deliverables: policies adopted, risk register items closed, security questionnaires answered and the turnaround on each, and the date of the latest board report. If you’re pursuing SOC 2 or ISO 27001, track the audit-readiness checklist and the number of control gaps remaining.
Then look at utilization and cost per outcome. Compare hours used with hours contracted, and divide the monthly fee by deliverables completed to see what each costs. If you’re paying $8,000 a month and using 4 of 10 hours, the problem may be your internal responsiveness rather than the vendor’s. If you regularly exceed the allotment, the right fix is a larger tier, not a stream of overage invoices at $250 to $400 an hour.
FAQs
How much does a vCISO cost per month in 2026?
BD Emerson reports $3,000 to $25,000 a month depending on days of leadership and scope, while Side Channel and Consilien both quote $3,000 to $20,000. Most mid-market companies with 200 to 500 employees see $5,000 to $12,000 a month, according to Side Channel and Consilien. Those are vendor-published estimates, not independent market data, and Consilien discloses that it sells the service. Treat the figures as ranges to test against 3 written quotes, and confirm what each includes before comparing prices.
Is a vCISO cheaper than a full-time CISO?
Usually yes, for companies under about 500 to 1,000 employees. BD Emerson puts a loaded full-time CISO at $250,000 to $400,000 or more per year, plus a recruiter fee of 25% to 30% of first-year pay. A fractional engagement at $60,000 to $144,000 a year, the mid-market range from Side Channel, costs a fraction of that. At the Embedded tier of $180,000 to $300,000, the gap narrows, and BD Emerson suggests pricing a hire once spend approaches $180,000 to $220,000.
How many hours a month does a vCISO retainer include?
It depends on the vendor and the tier. Consilien lists 5 to 8 hours for companies under 50 people, 8 to 15 for 50 to 200, 10 to 20 for 200 to 500 with an active audit, and 20 or more for regulated or multi-framework clients. BD Emerson counts days instead, from 1 to 2 for Advisory up to 8 to 12 for Embedded. Side Channel doesn’t publish hour counts, so get the number in writing, along with the rollover rule.
What’s usually billed on top of the retainer?
Side Channel and Consilien list required tools at $500 to $5,000 a month, overage hours at $250 to $400 an hour, penetration tests and audits at $10,000 to $50,000 or more, and implementation contractors at $2,000 to $10,000 a month if you lack internal IT staff. Early termination penalties of 2 to 3 months’ fees can also apply on 12 to 24 month contracts. In my illustrative scenarios, these extras made the retainer only 64% to 89% of the total annual spend.
Should I pay hourly or on a monthly retainer?
Hourly advisory, at $200 to $400 an hour per Side Channel and Consilien, suits ad hoc questions, second opinions or a quick assessment. It carries no guaranteed availability or continuity, though. A retainer is where ongoing program ownership sits, and Consilien says most companies end up there. If you need a named leader for customers or auditors, or you expect steady work each month, a retainer usually fits better. A fixed-scope project, at $10,000 to $75,000, suits a defined deliverable such as SOC 2 readiness.
When should I hire a full-time CISO instead?
Consider it when fractional spend approaches $180,000 to $220,000 a year, which is BD Emerson’s marker, or when your company is over about 1,000 employees, a range where Side Channel suggests $15,000 a month or more, or a full-time hire. Another signal is hours: if you regularly need 10 to 15 hours a week, which is 43 to 65 hours a month, a standard mid-market retainer will feel thin. Many companies use a fractional leader as a bridge during the 4 to 6 month search.
How long should a vCISO contract run?
Side Channel reports 12 to 24 month contracts with early termination penalties of 2 to 3 months’ fees. A first-year commitment is reasonable because a security program takes months to build and a vendor needs time to learn your environment. Push back on longer terms unless the contract allows exit for cause, such as missed deliverables or a change of the named lead. At $6,000 to $12,000 a month, those penalties run $12,000 to $36,000, so confirm the exit clause with counsel.
Does a vCISO replace my managed security provider or SOC?
No. A vCISO provides leadership and accountability, while a managed security provider watches alerts and responds to threats. BD Emerson describes the Embedded tier as including management of internal staff and the managed security provider, which shows the roles complement each other. My read is that the vCISO should decide what the provider monitors and review its performance. If a vendor offers both, ask about the conflict of interest BD Emerson flags when a firm sells the tools it recommends.
