Virtual CISO
A security leader when you need one. Not a full-time seat.
Fractional security leadership for organisations that need decisions, priorities and board-level clarity — without hiring a full-time CISO before the work justifies it.
When a vCISO makes sense
A virtual CISO is useful when security decisions are landing on a CTO, COO or founder who already has another job. You may be facing a customer security questionnaire, a funding round, a DPDP obligation, an audit or an incident — and you need someone who can own the security agenda without adding a permanent executive salary.
We work as an accountable adviser, not a report factory. That means joining the decisions where risk is created: architecture, vendors, product changes, access, exceptions and incidents.
What we run
- Security strategy and 90-day plan. A realistic sequence tied to business priorities.
- Risk register and treatment decisions. Clear owners, rationale and review dates.
- Policy and standards. Written for how your teams actually work, not for a shelf.
- Board and investor reporting. Plain-language exposure, progress and asks.
- Vendor and third-party review. Security questions that produce decisions, not paperwork.
- Incident readiness. Roles, runbooks, tabletop exercises and post-incident review.
- Security roadmap. Sequenced initiatives with dependencies, effort and evidence.
Engagement models
| Model | Best for | Typical shape |
|---|---|---|
| Advisory | A specific decision, audit or board question | Short engagement, defined question, written recommendation |
| Fractional | Ongoing leadership without a full-time hire | Monthly cadence, risk register, roadmap and reporting |
| Embedded | A transition period or an active programme | Deeper involvement with your team, delivery and handover |
Typical fractional engagements run at two to five days per month, scoped to the decisions and cadence you need. We agree the shape in writing before we start.
What you get
How it works
- Context. Understand the business, obligations, current controls and constraints.
- Baseline. Establish the risk register, gaps and priority decisions.
- Cadence. Agree the operating rhythm: reviews, reporting, escalations and decisions.
- Delivery. Drive the roadmap with your team and bring in specialist help where needed.
- Handover. When you hire a full-time CISO, we help transfer context and evidence.
A vCISO advises and drives the programme; your organisation remains accountable for risk decisions. We make the trade-offs explicit so the right person can decide with the right information.
Questions we hear
Do we need a full-time CISO instead?
If you have a large regulated estate, a mature security team and continuous executive demands, a full-time CISO may be right. A vCISO can also bridge the gap while you hire, or cover a specific programme without adding a permanent role.
Can you present to our board?
Yes. We prepare plain-language reporting on exposure, progress, incidents and decisions needed. The board retains its oversight role; we provide the security context it needs.
Do you manage the security team?
We can set direction, priorities and operating cadence, and work alongside your technical leads. Direct line management of your staff is agreed separately and only where it makes sense.
Are you available for incidents 24/7?
Our standard engagements are not a 24/7 managed service. We help you build incident readiness and can be engaged for incident support by agreement. If you need continuous monitoring, we will tell you what that requires rather than imply it is included.
Virtual CISO
Bring senior security judgement into the room.
Tell us the decision in front of you. We will tell you whether a vCISO is the right shape for it.