Advisory · Virtual CISO
Senior security leadership, without the full-time hire.
A named virtual CISO sets your security strategy, runs the program, reports to the board and answers customer questions, for a fraction of a full-time executive.
- Commitment
- Monthly retainer
- Time
- 2–8 days per month
- Lead
- One named, senior CISO
Board pack · Q3 risk registerSimulated environment, real workflow.
Scope
What we cover.
Pick what matters for this engagement. We help you scope it in the first call.
Strategy and roadmap
A 12–24 month plan tied to business goals and the risks that matter.
Board and investor reporting
Quarterly reporting on risk, progress and spend, with loss scenarios in financial terms.
AI governance
An AI usage policy, an AI risk register and a board briefing on where AI is used and what could go wrong.
Policy and program
Policies, standards and the operating rhythm that keeps them current.
Customer assurance
Security questionnaires, sales calls and trust-center content.
Incident leadership
Executive decision-making and communications during a serious incident.
Methodology
How the engagement runs.
Five steps, the same on every engagement, with a named lead from scoping to sign-off.
- 01
Baseline
Assess the program, interview leaders and review recent incidents and audits.
Output: Program baseline
- 02
Prioritize
Agree the top risks and a roadmap the leadership team signs off.
Output: Risk roadmap
- 03
Run
Lead the program day to day: meetings, owners, decisions and vendors.
Output: Owner tracker
- 04
Report
Monthly metrics for leadership and quarterly board reporting.
Output: Board pack
- 05
Hand over
When you are ready to hire, help recruit and onboard a full-time CISO.
Output: Hiring brief
Maturity
Where your programme stands, and where six months gets it.
We score each NIST CSF 2.0 function in the first month and set a target tier the board signs off. Toggle between today and the six-month plan.
- Today
- After 6 months
| Area | Today | After 6 months |
|---|---|---|
| Govern | 1.5 | 3.0 |
| Identify | 2.5 | 3.0 |
| Protect | 2.5 | 3.0 |
| Detect | 1.5 | 3.0 |
| Respond | 2.0 | 3.0 |
| Recover | 1.0 | 2.5 |
Simulated environment, real workflow.
Deliverables
What you walk away with.
Written for the engineers who fix things and the leaders who fund them.
- Named lead for the whole engagement
- Critical issues flagged the same day
- Retest included
Security strategy
A roadmap the leadership team has agreed and can track.
Board reporting
A quarterly pack with risks, progress and decisions needed.
Risk register
Top risks with owners, treatment plans and financial estimates.
Policy set
Policies and standards ready for SOC 2, ISO 27001 and customer reviews.
FAQ
Questions we hear most.
Who will our vCISO be?
One named, senior practitioner who stays with you, backed by our wider consulting and GRC team.
How much time do we get?
Usually two to eight days a month, adjusted as needs change.
Can the vCISO handle customer security reviews?
Yes. Questionnaires, security calls with prospects and trust-center content are a common part of the role.
Can the vCISO own AI governance?
Yes. Most boards now ask about AI. Your vCISO keeps the AI inventory, policy and risk register, backed by our AI Security practice.
What happens when we hire a full-time CISO?
We help write the role, interview candidates and hand over the program cleanly.
Related
Often paired with.
AI Governance
ISO/IEC 42001, NIST AI RMF and EU AI Act readiness, built on one control set and real test evidence.
ExploreRisk & Compliance
SOC 2, ISO 27001, privacy and audit readiness from the same team.
ExploreSecurity Architecture
Zero Trust, cloud and identity design reviews with a phased roadmap.
ExploreScope your Virtual CISO engagement.
A 30-minute call with a senior practitioner. You leave with a scope, a timeline and a fixed quote.