What is a Virtual CISO (vCISO)?

A Virtual CISO (vCISO) is a security leader you rent by the month instead of hiring. That is the whole idea. Everything else is detail about scope and price.

The reason the question gets asked is almost always the same: a customer has sent a security questionnaire, an insurer has asked who owns security, or a SOC 2 auditor has asked to see the person accountable for the program. Somebody has to sign their name to the answers, and in a company of forty people there is often nobody whose job that is.

A vCISO takes accountability for your security and AI governance program without joining your payroll. Practically, that means owning the risk register, the policy set, the compliance roadmap, the vendor reviews, the incident response plan and the reporting that your board, insurer, auditor and customers all ask for.

Most descriptions of this role list responsibilities. Here is the actual sequence we run, which is more useful if you are trying to decide whether you need one.

Weeks 1 to 4. Read what already exists. Interview the founders, engineering lead and whoever handles IT. Build the asset and data inventory, because nobody has one. Pull the open customer security questionnaires and the insurance application, since those define the real deadlines. Produce a risk register with owners and dates, not a maturity score out of five.

Weeks 5 to 8. Fix the things that are both cheap and load bearing: multi factor authentication with no executive exceptions, offboarding that actually removes access, a named owner for patching, backups that have been restore tested. Write the policy set your auditor will ask for, sized to the company you are rather than copied from an enterprise template.

Weeks 9 to 12. Stand up the recurring rhythm: vendor review at onboarding, quarterly access review, an incident response plan that has been walked through out loud, and a one page board or investor update. Then the compliance roadmap, whether that is SOC 2, ISO 27001, ISO 42001, CMMC or several at once. If a provider cannot describe their first ninety days in that kind of detail before you sign, that is your answer.

1. A customer has sent a security questionnaire you cannot answer. Especially if they are enterprise or public. Buyers are still building this muscle: KPMG's 2026 Global Third Party Risk Management Survey of 851 organisations found only 18 percent have third party risk fully integrated with enterprise risk management, and just 15 percent of leaders are highly confident in their own third party data. Immature programs ask for more evidence, not less, and in our experience a stalled questionnaire stalls the deal behind it.

2. Your insurer is asking who is accountable for security. This is not a soft trend. Chubb's cyber proposal form asks outright for contact details of the CISO or the staff member responsible for data and network security, whether there is a cyber specific incident response plan tested at least annually, and whether multi factor authentication is required for email and business critical cloud applications. Carriers increasingly want evidence rather than attestation. Answering loosely is a coverage problem later.

3. You have started selling into a regulated sector. Healthcare, financial services and defence supply chains all push obligations down to their suppliers regardless of your headcount.

4. You are shipping AI features, or <a href="https://irmcon.com/blog/vciso-ai-risks-threats/" target="_blank" rel="noopener">your staff are using AI tools you have not approved</a>. This is the newest trigger we see, and now the most common. ISO/IEC 42001, published in December 2023, is the certifiable AI management system standard, and enterprise buyers have started asking about it the way they once asked about ISO 27001. The EU AI Act adds legal obligations, though be careful with the timeline: prohibited practices and AI literacy duties have applied since February 2025 and general purpose model obligations since August 2025, but the Digital Omnibus agreement has pushed the main high risk obligations out to December 2027 and August 2028. The commercial pressure is arriving well ahead of the legal deadline.

5. Something already happened. A phishing incident, a lost laptop, an ex employee who still had access. The window after a near miss is when the budget exists.

We turn work away for these reasons more often than you might expect, and any provider who never does should worry you.

You are under ten people with no customer data and no compliance driver. Turn on multi factor authentication everywhere, get password management in place, enable automatic updates, back up to something with version history. That is most of your risk, and it is a weekend, not a retainer.

What you actually need is implementation, not direction. If you already know what to do and just need someone to configure it, hire a managed service provider or a contractor. A vCISO who ends up doing configuration work is expensive labour.

You have a competent internal security lead already. Then what you want is a specific engagement, a gap assessment, a certification readiness sprint, a threat model, not a standing retainer that duplicates them.

You are buying it only to put a name on a form. It will not survive contact with an auditor, and it damages you more than having nobody.

Nobody internally has time to work with them. A vCISO needs decisions from you. Without an internal owner who can allocate engineering time, you will pay for a document set that nobody implements. This is the single most common way these engagements fail.

The section above covers the five situations where a vCISO is the wrong purchase. Two more are worth naming.

The security ask has not arrived yet. If no customer, insurer or investor has put a requirement in writing, buy a one-off gap assessment instead of a retainer. It gives you a prioritized list and a document you can show the first buyer who asks. Start the retainer when the deadline exists.

You already have a compliance platform and think it replaces the role. Automated evidence collection is useful, but it does not decide which controls apply, own the risk register, or sit in front of an auditor. If someone internally can answer the auditor's questions, a few hours of advisory a quarter may be enough.

In both cases the right answer is smaller and cheaper than a vCISO, and a provider who cannot say so should be treated with caution.

We run Virtual CISO services for small and mid sized companies across Canada and the United States, with a heavy concentration in SaaS and in companies now facing AI governance obligations for the first time. Engagements are monthly retainers or fixed scope sprints, and the certification readiness work covers SOC 2, ISO 27001, ISO 42001 and CMMC.

The related pieces of the program sit under governance, risk and compliance, process, risk and controls and data security and privacy. Pricing and the ROI calculator are on the cybersecurity pricing page.

If you would rather test your position before speaking to anyone, our free assessment tools score you against recognised baselines in about twenty minutes, with no sales call attached.

Related reading: governance, risk and compliance explained, the ISO 42001 readiness checklist, and incident response for small business.

Or book a call and we will tell you which of the five signals above actually apply to you, including if the answer is none of them.