What does a vCISO cost?

A vCISO costs whatever the scope, the seniority of the person doing it, and the engagement model add up to. There is no single sticker price, and anyone who quotes you one without asking about your business is guessing. The honest answer is that cost is a function of three variables: how much security leadership you actually need, how experienced the person providing it is, and whether you buy that capacity by the day, on a monthly retainer, or as a permanent salary. Get those three right and the number falls out of them. The rest of this page explains each driver so you can budget with confidence, and points you to the Starkhorn pricing page and the cost calculator for figures specific to your situation rather than averages that may not fit.

The three engagement models, compared

There are three realistic ways to buy chief information security officer capability, and they sit on a spectrum of commitment.

A day rate suits short, defined pieces of work: a security assessment, a board paper, due diligence on an acquisition, or stabilising things after an incident. You pay only for the days used, so it is the most flexible option, but the per day figure is the highest of the three because you are buying experience without any commitment in return. It works best when the task has a clear end.

A monthly retainer is the natural home of the virtual CISO and CISO as a service model. You agree a set amount of senior attention each month: a standing rhythm of risk reviews, policy ownership, supplier oversight, board reporting and being on hand when something breaks. The monthly figure is lower than the equivalent in ad hoc days because both sides commit, and you get continuity rather than a stranger relearning your environment each time. For most mid market organisations this is the model that makes the budget work.

A full-time salary buys a permanent CISO. For organisations large enough to keep one fully occupied, that is the right answer. The published range tells you the scale of that commitment: a UK CISO salary runs roughly £95,000 to £600,000 or more, before you add employer national insurance, pension, recruitment fees, equity and the months the role sits empty while you search. That total cost of employment is the real number to compare a fractional arrangement against, not the headline salary alone.

What actually drives the price up or down

Within any model, a handful of factors move the number.

• Scope. A pure governance and board reporting mandate costs less than one that also owns incident response, a compliance programme and a security operations function.
• Seniority. A genuine board-level operator who has carried profit and loss and sat in front of investors commands more than a hands-on practitioner, and is worth it when the work is strategic.
• Regulatory load. Sectors carrying heavy obligations, such as financial services or anything in scope of NIS2, demand more leadership time, so they cost more to cover properly.
• Risk profile. If you hold sensitive data, run critical operations or have just been through an incident, the intensity goes up and so does the figure.
• Maturity. An organisation starting from a low base needs more frequent attention early on; a mature one needs steady oversight.

This is exactly why the cost calculator exists. Rather than quote you an average that fits nobody, it asks about these drivers and returns a range grounded in your answers.

Why fractional usually costs less than a permanent hire

The instinct is that a full-time hire must be cheaper per hour than a senior contractor. For the work most mid market organisations actually need, the opposite is true. A permanent CISO is a fixed cost whether or not there is a full week of strategic work each week, and in many businesses there genuinely is not. A fractional CIO and CISO arrangement lets you buy the senior judgement at the cadence the work demands and stop paying for the gaps. You also skip the recruitment fee, the onboarding lag, and the gamble of a single permanent appointment in a discipline where the wrong hire is expensive to unwind. The day rate looks higher in isolation, but measured against the fully loaded cost of employment, the fractional total is usually lower for the same outcomes. The honest exception is the organisation with enough sustained security work to keep a full-time leader busy: there, hire one.

What the cost is protecting you against

Budgeting for security leadership is easier when you weigh it against what poor governance costs. The global average cost of a data breach reached USD 4.44 million in IBM’s 2025 Cost of a Data Breach Report. Regulators in the UK have shown they will act: the ICO fined British Airways £20 million in 2020 and Interserve £4.4 million in 2022. A vCISO retainer is a small, predictable line item set against exposure of that order. The point of the spend is to make sure someone senior owns your board cyber governance, keeps your incident response plan current, and steers emerging risks like AI governance and shadow AI before they turn into a headline.

Where a vCISO sits next to the other options

Cost only makes sense in context. If your gap is broader than security, a vCIO or IT strategy consulting engagement may be the better spend. If you need defined project help rather than ongoing leadership, scoped cyber security consulting on a day rate is more efficient. If a leader has just left, an interim appointment to cover the leadership gap bridges the period without a rushed permanent hire. And if you are weighing an acquisition, technology due diligence is a fixed, time-boxed cost. The right model is the cheapest one that fully covers the work in front of you, not the cheapest one on paper.

Why Starkhorn

Starkhorn is led by Daniel J. Jacobs, who has spent over 20 years in technology and security, 15 of them in leadership roles, including Interim Group Technology Director at VetPartners, the BC Partners-backed veterinary group, and CIO and CISO at Jardine Motors Group. He is the author of The Strategy Bridge and holds PRINCE2, ITIL Foundation and full membership of the Institute of Interim Management.

Having carried both the CIO and CISO mandate at group level and stepped into an interim leadership role inside a private equity-backed group, Daniel can tell you candidly which engagement model fits the work in front of you and what it should genuinely cost, rather than selling you more cover than you need.

Frequently asked questions