What is a CISO salary in the UK?

A UK CISO salary runs roughly £95,000 to £600,000 or more, according to recruiter data (DWH). That spread is not noise. It is the whole story. The same job title covers a part-time security lead at a small charity and a global Chief Information Security Officer at a listed bank, so any single number is misleading unless you pin down scope, sector and seniority first. Before you anchor on a figure, decide what you are actually buying: a hands-on operator, a board-facing strategist, or both. That decision moves the cost more than anything else.

What drives the cost

Three things set the price, and none of them is a postcode. The first is scope: a CISO who owns strategy, board reporting, regulatory compliance, vendor risk, incident readiness and a security team costs far more than one brought in to fix a single problem. The second is seniority: someone who has carried accountability for a breach response, sat in front of regulators and presented risk to a board commands a premium over a capable manager stepping up. The third is sector and regulation: financial services, healthcare and any organisation in scope for new rules pay more because the consequences of getting it wrong are larger. If you operate under tightening regulation, our work on NIS2 compliance and cyber security for financial services shows how scope expands fast once compliance enters the picture.

The cost of getting security wrong frames the cost of the role. The IBM Cost of a Data Breach Report 2025 puts the global average breach at USD 4.44 million. Closer to home, the ICO fined British Airways £20 million in 2020 and Interserve £4.4 million in 2022. Set against those numbers, the question is rarely whether to fund security leadership, but how to fund it efficiently.

The three engagement models, compared

You can buy CISO capability in three broad ways, and the right one depends on how much of a full-time leader you genuinely need.

• Full-time salary. You hire a permanent CISO on payroll. You pay the salary, plus employer national insurance, pension, bonus, recruitment fees and the cost of the months the seat sits empty while you search. This makes sense when security leadership is a daily, full-time job: a large team, constant regulatory pressure, a complex estate.
• Monthly retainer. You engage a fractional CIO and CISO for an agreed number of days each month. You get senior judgement on a predictable budget, without carrying a full salary. This suits most mid-market organisations, where the work is real and ongoing but does not fill a five-day week.
• Day rate. You buy a defined block of work or interim cover at a day rate. This fits a specific deliverable, a leadership gap, or a crunch period such as a funding round or a post-incident clean-up.

We keep our fee structure plain rather than dressing it in mystery. The pricing page sets out how the retainer and day-rate models work, and the cost calculator lets you model what your specific scope would cost before you speak to anyone.

Why fractional and interim usually cost less

A permanent CISO salary buys you a person for five days a week. Most mid-market organisations do not have five days a week of CISO-grade work, so a chunk of that salary funds capacity you do not use. A CISO as a service arrangement, sometimes described as a virtual CISO, matches the cost to the actual workload. You pay for the days you need and nothing more.

The saving is larger than the headline rate suggests, because the full cost of a permanent hire is more than the salary line. Add recruitment fees, pension, national insurance, the productivity lost during a hiring search that often runs for months, and the risk of hiring the wrong person into a role that is hard to assess. A fractional or interim leader starts in days, brings patterns from multiple organisations, and can be scaled up or down as your needs change. For organisations that need senior cover during a transition, our interim cover for a leadership gap is built precisely for that situation.

What the budget actually has to fund

Whichever model you choose, the work is the same set of responsibilities, and seeing them listed helps you judge whether the price is fair. A CISO sets security strategy and translates it for the board through board cyber governance. They prepare the organisation to respond when something goes wrong, which is why an incident response plan and tested ransomware readiness sit near the top of the list. They govern emerging risk, including the fast-moving questions around AI governance and shadow AI. And they bring rigour to risk assessment and vendor scrutiny, the kind that underpins cyber security consulting and technology due diligence. When you compare a quote against this list, you are comparing value, not just a rate.

Matching the model to your situation

If security leadership is a daily, full-time job with a team to manage and constant regulatory load, a permanent salary is the right call and you should budget at the higher end of the range. If the work is genuinely important but intermittent, a retainer gives you senior judgement without the full overhead. If you have a defined gap or a one-off deliverable, buy interim cover at a day rate. Many organisations also need technology leadership alongside security, which is where a combined virtual CIO engagement or our wider IT strategy consulting earns its place. The honest answer is that the cheapest option is the one matched to your real workload, not the lowest rate on a page.

Why Starkhorn

Starkhorn is led by Daniel J. Jacobs, who has spent over 20 years in technology and security, 15 of them in leadership roles, including Interim Group Technology Director at VetPartners, the BC Partners-backed veterinary group, and CIO and CISO at Jardine Motors Group. He is the author of The Strategy Bridge and holds PRINCE2, ITIL Foundation and full membership of the Institute of Interim Management.

Having carried both CIO and CISO accountability inside a large group, and led technology through a backed transition, Daniel can tell you candidly which engagement model fits your scope and what it should cost, rather than selling you more leadership than the work needs.

Frequently asked questions