The short answer

A vCISO is a senior security leader you engage on a part-time, fractional or retained basis, usually a few days a month, to set strategy, own risk and steer your security programme. An in-house CISO is a permanent, full-time executive on your payroll who does the same job and is present every day. The work is largely identical. What differs is presence, cost and how much continuous, hands-on involvement the role demands. For most mid-market and private-equity-backed businesses, a virtual CISO delivers the leadership you need without the cost and recruitment risk of a full-time hire, and it is the right starting point in the large majority of cases.

What an in-house CISO actually does

A permanent CISO owns the organisation’s security posture end to end. They define the strategy, set policy, manage the security budget, build and lead a team, report risk to the board, and run the response when something goes wrong. They are accountable when an incident lands and they live with the consequences. For a large enterprise with a complex estate, a substantial security team to manage, heavy regulatory exposure and a constant flow of security decisions, a full-time CISO earns their keep precisely because the work never stops.

The catch is cost and supply. A UK CISO salary runs roughly £95,000 to £600,000 or more depending on sector and scale, before bonus, equity, benefits and the cost of the team beneath them. Strong candidates are scarce, hiring takes months, and a senior leader sized for a problem you do not yet have is expensive idle capacity. If your security workload does not genuinely fill a full week of executive time, you are paying enterprise prices for capacity you will not use.

What a vCISO actually does

A vCISO does the same strategic job, scaled to what you need. They assess your current posture, build a prioritised roadmap, write the policies that were never written, prepare you for audits and customer due diligence, brief the board in language it understands, and stand up incident readiness before you need it. The difference is cadence. Instead of a permanent seat, you get a senior operator for an agreed number of days, focused on the decisions and deliverables that move your risk needle. Starkhorn delivers this as CISO as a service, and you can read the fuller definition on our what is a vCISO explainer.

Because a vCISO has run security across multiple organisations, you also buy pattern recognition. They have seen which controls matter, which audits trip people up, and which spending is theatre. That breadth is hard to get from a single in-house hire whose entire experience is your one environment.

The real differences: remit, focus, cost and speed

On remit, both own strategy and risk. The in-house CISO additionally absorbs the day-to-day operational load: team management, vendor escalations, the constant drip of small decisions. A vCISO concentrates on the high-leverage strategic and governance work and leaves routine operations to your internal staff or managed providers, which keeps the engagement focused and the bill honest.

On focus, a permanent CISO is embedded and always available, which matters when you are firefighting daily. A vCISO is deliberately selective, which is an advantage when your need is direction and structure rather than constant presence.

On cost, the gap is stark. A vCISO costs a fraction of a loaded full-time package because you pay for days used, not a salary, bonus, equity and benefits. You can size the model up as your risk grows. Our pricing is transparent, and the CIO and CISO cost calculator lets you compare the two side by side for your own numbers.

On speed, a vCISO starts in days, not the months a permanent hire takes to source, vet and onboard. When a customer contract, a funding round or a regulator forces the issue, that head start is the difference between passing and stalling.

When each one fits

Hire a full-time in-house CISO when security is genuinely a daily, full-time job: a large team to lead, a complex regulated estate, constant board-level scrutiny and enough recurring decisions to justify a permanent executive. At that scale, presence and continuity outweigh the premium you pay.

Engage a vCISO when you need senior leadership and clear direction but not a permanent full-time seat: you are mid-market, scaling, post-acquisition, or facing a specific trigger such as a NIS2 compliance obligation, customer security questionnaires, an incident response plan gap, or new exposure from AI governance and shadow AI. A vCISO also works well as a bridge: leadership now, while you decide whether the role ever justifies a permanent hire.

The verdict for mid-market and PE-backed businesses

For most mid-market and private-equity-backed companies, the vCISO wins, and not by a narrow margin. Your security workload rarely fills a full executive week, your budget is watched closely, and your need is usually direction, governance and audit readiness rather than a standing team. A vCISO gives you board-grade leadership at a fraction of the cost, starts immediately, and scales with you. The IBM Cost of a Data Breach Report 2025 put the global average breach at USD 4.44 million, and UK regulators have shown they will act, with the ICO fining British Airways £20 million in 2020 and Interserve £4.4 million in 2022. The exposure is real. What you are choosing is the most efficient way to lead against it, not whether to lead at all.

There is a further advantage particular to backed and acquisitive businesses. The technology and security gaps a CISO closes rarely sit neatly apart from the CIO agenda. Starkhorn often provides more than one of these roles under one person: a single operator can run security as your vCISO while also covering the wider technology agenda as your vCIO or fractional CIO and CISO. That joins up IT strategy, digital transformation and security under one accountable leader, which is exactly what investors want to see during technology due diligence and through a hold period.

Why Starkhorn

Starkhorn is led by Daniel J. Jacobs, who has spent over 20 years in technology and security, 15 of them in leadership roles, including Interim Group Technology Director at VetPartners, the BC Partners-backed veterinary group, and CIO and CISO at Jardine Motors Group. He is the author of The Strategy Bridge and holds PRINCE2, ITIL Foundation and full membership of the Institute of Interim Management.

That mix of group-level technology leadership in a PE-backed environment and combined CIO and CISO accountability is precisely the breadth a vCISO engagement draws on, which is why Starkhorn can hold security strategy and the wider cyber security agenda under one person rather than spreading it across separate hires.

Frequently asked questions