vCISO or full-time CISO? How to choose

A few years ago, many mid-sized companies could leave security to the IT manager. That is getting harder to defend. NIS2 and DORA put cyber security on the management agenda, customers send longer security questionnaires, and insurers ask who is in charge. So the question is no longer whether someone should own security, but what kind of role it should be.

What each option really is

A full-time CISO is an executive employee, embedded in the business and in its daily decisions. A virtual CISO (vCISO) is an experienced security leader who joins you part time on a retainer, leading the same programme for an agreed number of hours.

Neither is automatically better. They suit different situations.

Three questions that usually settle it

• How much leadership does the job actually need? If the work is strategy, risk decisions, board reporting and framework oversight, it may not fill five days a week. If it is daily and constant, it probably does.
• How big is the team being led? A large in-house security team needs a manager who is there every day. A small IT team with a good provider often does not.
• How often do you deal with regulators? Constant supervisory contact, complex risk and frequent incidents all point towards a full-time role.

What about cost?

Recruiter benchmarks for 2026 put CISO base pay at roughly €100,000 to €145,000 at smaller companies in Western Europe, and considerably more at larger ones, with total compensation often well above base. Salaries vary by country and sector, and experienced candidates are in short supply, so searches can take time.

A vCISO costs a monthly retainer sized to the hours you need. The saving is real when the workload is part time, but it narrows as the hours grow. If you need someone three or four days a week, every week, it is worth running the numbers on a permanent hire.

A vCISO carries the workload, not the accountability. That stays with your management, whichever model you choose.

What a vCISO does not change

Under NIS2, management bodies approve the security measures, oversee them and can be held liable. Under DORA, the management body holds ultimate responsibility for ICT risk, and entities other than microenterprises need an independent control function. PCI DSS expects responsibility to be formally assigned to a CISO or a knowledgeable executive. A vCISO can do much of the work and give the advice, but these duties need a clear internal owner, and the set-up should be agreed at the start.

A common path

Many organisations start with a vCISO to build the programme and reach compliance, then decide whether the workload justifies a permanent hire. When it does, the vCISO can help to write the role, assess candidates and hand over, leaving a programme that already works.

See how our vCISO service works, including a side-by-side comparison with a dedicated CISO.