What a vCISO is, in one sentence

A vCISO, or virtual Chief Information Security Officer, is an experienced security leader who works for your organisation on a part-time, fractional or retained basis, setting and running your security strategy without the cost or commitment of a permanent executive. You get board-level judgement on a few days a month rather than a full salary on the payroll. The role is the security equivalent of a vCIO, and the two are often delivered by the same person where a business needs both technology and security leadership. Starkhorn delivers it as a clear, scoped service through our virtual CISO and CISO as a service offerings.

What a vCISO actually does

The job is not patching servers or running a SOC. A vCISO owns the security agenda. That means understanding the risks specific to your business, setting priorities against them, and reporting in language the board and auditors can act on. In practice the work covers building and maintaining a security strategy and roadmap, owning the risk register, defining policy and controls, running supplier and contract due diligence, preparing for audits and certifications, and standing up an incident response plan so the organisation knows what to do when something goes wrong rather than improvising under pressure.

A good vCISO also translates. Technical teams know what is broken. Boards know what they are worried about. The vCISO sits between the two, turning technical exposure into commercial decisions about what to fix, what to accept, and what to insure. That bridge is most of the value. It is also why the role belongs with someone who has carried executive accountability, not a contractor working from a checklist. Much of this overlaps with broader cyber security consulting, but a vCISO is an ongoing accountable owner rather than a project resource.

When your business actually needs one

You need a vCISO when security has become a board-level question but cannot yet justify a board-level salary. A few clear triggers tend to bring the conversation forward.

• A customer, insurer or investor is asking who owns security, and you do not have a credible answer.
• You are pursuing a certification such as ISO 27001 or Cyber Essentials and need someone to own the programme.
• New obligations apply to you, for example NIS2 compliance or sector rules, and nobody internal is accountable for meeting them.
• You have had a near miss or an incident and the response exposed how exposed you really are.
• You are mid-market, growing fast, and security has been bolted onto an IT manager who is already stretched.

The recurring theme is accountability without capacity. A vCISO fills that gap from day one, which is also why so many of these engagements sit alongside a fractional CIO and CISO arrangement when both seats are empty.

How a vCISO differs from the roles it gets confused with

The labels overlap, which causes most of the confusion. A vCISO and a virtual CISO are the same thing: virtual and the v prefix both mean remote and part-time. CISO as a service is the packaged, productised version of the same role, usually with defined deliverables and a fixed monthly fee. A full-time CISO is the permanent executive equivalent, and in the UK that role commands a salary running roughly from £95,000 to well over £600,000 depending on sector and scale, which is precisely the cost a vCISO lets you avoid.

The sharper distinction is against the vCIO. A vCIO owns technology strategy: systems, infrastructure, digital change and IT spend. A vCISO owns security and risk. They are adjacent and complementary, not interchangeable. The other common confusion is with a managed security provider or consultancy that sells tools and monitoring. Those deliver a service. A vCISO provides leadership and decides, with you, whether those services are the right ones to buy at all.

What a vCISO does not do

Being clear about the boundaries saves disappointment. A vCISO is not a 24/7 operations team and will not replace your help desk, your SOC or your tooling. They are not a one-off auditor who hands you a report and leaves. And they are not a substitute for technology leadership: if your core problem is failing systems or a stalled transformation, that is a job for IT strategy consulting or a mid-market digital transformation lead, possibly the same person wearing the other hat. What a vCISO does is own the security agenda and make sure the right work happens, in the right order, for the right reasons.

Where a vCISO adds the most value

The highest return tends to come at the points where security meets a commercial decision. Reassuring the board and answering due diligence questions cleanly, so deals and contracts do not stall. Getting ahead of emerging exposure such as shadow AI and putting sensible AI governance in place before it becomes a problem. Building genuine ransomware readiness rather than hoping. Supporting a transaction with proper technology due diligence. For regulated firms, the value is sharper still: see how this plays out in cyber security for financial services. The cost of getting this wrong is concrete, not theoretical. The IBM Cost of a Data Breach Report 2025 puts the global average breach at USD 4.44 million, and the ICO has shown it will act, fining British Airways £20 million in 2020 and Interserve £4.4 million in 2022.

Why Starkhorn

Starkhorn is led by Daniel J. Jacobs, who has spent over 20 years in technology and security, 15 of them in leadership roles, including Interim Group Technology Director at VetPartners, the BC Partners-backed veterinary group, and CIO and CISO at Jardine Motors Group. He is the author of The Strategy Bridge and holds PRINCE2, ITIL Foundation and full membership of the Institute of Interim Management.

Having held the CIO and CISO seat inside a large group, Daniel runs a vCISO engagement the way an accountable executive would, owning the security agenda and translating it into decisions the board can act on, rather than handing over a report and leaving.

Frequently asked questions