Our CEO, Ben de la Salle, recently posted this article on LinkedIn, discussing the role of the Fractional CISO
In today’s fast-evolving threat and regulatory landscape, organisations need strong cybersecurity leadership. However, hiring a full-time Chief Information Security Officer (CISO) isn’t always the most viable solution. That’s where a Fractional CISO steps in.
A Fractional CISO provides the expertise of a seasoned cybersecurity leader, but on a part-time or project basis. This flexible approach offers organisations the strategic guidance they need without the overhead of a full-time hire.
In this short article I wanted to consider some of the key aspects of the Fractional CISO role, and why it is gaining traction.
Note to reader: I have not, on purpose, covered the variations of vCISO, Fractional CISO and CISO-as-a-Service with the main body of this article. Ultimately, businesses are obtaining part-time support for this role, and for the purpose of this article those terms can be interchangeable.
However, from my research and experience:
vCISO services tend to be provided by Managed Service Providers as a consultative role alongside some other managed service.
Fractional CISOs tend to be individuals providing direct services to their clients, perhaps working with a few associates, who also support clients.
CISO-as-a-Service (CISOaaS), certainly from our perspective, is a service that provides access to a named industry experienced CISO, enabling access to a variety of capabilities as part of the service.
Benefits of a Fractional CISO
What makes selecting a Fractional CISO a smart choice? There are a number of compelling reasons:
Cost-Effective Expertise
Fractional CISOs deliver the same strategic leadership as full-time CISOs but at a fraction of the cost. Depending on the level of support required, services typically range from £11,000 to £85,000 per year, compared to a full-time CISO’s average salary exceeding £150,000, excluding benefits and bonuses.
The salary expectations can dramatically increase depending on location and industry.
Flexibility
They adapt to the organisation’s needs, scaling their involvement during critical projects or compliance deadlines.
Engagements will often involve a baseline service, covering governance, risk management, and other key objectives, coupled with an ability to flex to demand.
Industry Expertise
Fractional CISOs often bring cross-industry insights, enabling them to address unique challenges. For example, a CISO with experience in a highly regulated sector, such as financial services, can bring that rigour, with a layer of pragmatism, to less regulated businesses, helping improve their overall security risk management practices.
Unbiased Perspective
As external consultants, Fractional CISOs provide objective recommendations, unclouded by internal politics. They also pride themselves on vendor and technology independence, whilst maintaining a broad experience with various providers to support quick and effective decision making.
Specifically, at ICA Consultancy Ltd, we are fully transparent about all our relationships, commercial or otherwise, with potential suppliers. Given my 25+ years in the industry it is hard not to know quite a few of the key players.
When to Consider a Fractional CISO
A Fractional CISO might be the right fit if:
Your organisation lacks in-house cyber security leadership.
You’re navigating complex compliance requirements, such as DORA or NIS2, and lack internal capability or capacity.
Your business is growing, and security needs, or client expectations, are becoming more complex.
You’re exploring emerging technology, such as AI, and the associated governance and need guidance on mitigating associated risks.
You’ve experienced a breach and need immediate guidance.
It’s also important to consider your awareness of your business’s security weaknesses, the strategic importance of cyber security, and the expertise already available in-house.
Ideally, the engagement should work in part as knowledge transfer, helping to up skill team members internally, as I discussed with IT Brew, What to look for in a Virtual CISO.
What to Look for in a Fractional CISO
The first question for any Fractional CISO candidate should be, in my humble opinion, whether they have a background as a full-time leader in security. As I mentioned in IT Brew's What to look for in a Virtual CISO, “There is experience taken from working in industry that you just don’t get being an external supporting a business.”
However, there are some other aspects to consider when interviewing a Fractional CISO:
What’s their experience with similar industries or challenges?
For example, have they worked with compliance-heavy sectors like healthcare or finance?
Look for a candidate with a proven track record of industry experience, not just in consultancy. Someone who has experienced that pain involved with defending the business that pays their wage from cyber attacks will both look to proactively mitigate them before they happen and have the experience to support you when they do happen.
How do they align security with business objectives?
A strong Fractional CISO understands how to balance risk mitigation with operational efficiency. Security is no longer the "Business Prevention team", and sometimes we need to articulate the risks well enough to support the opportunity that presents them.
Can they provide references or case studies?
Testimonials from past clients can offer valuable insights into their effectiveness.
Do they have the required breadth and depth?
Depending on your requirements, you may need to cover a variety of capabilities, such as setting strategic direction, supporting cultural change, informing technical decisions, and driving risk-based discussions across the business. You won't always find all of those in one individual, although it is not impossible. Consider what is your priority, and how you can support any requirements not fulfilled by the individual.
The Fractional CISO’s Role in the Cyber Industry
Beyond individual engagements, Fractional CISOs play a pivotal role in shaping the cyber security landscape:
Knowledge Sharing: Many can contribute unique perspectives to working groups or industry forums, sharing insights on emerging threats and best practices. See my LinkedIn post on this here.
Mentorship: They often mentor in-house IT teams, fostering a culture of security awareness, and ups killing existing talent. We have performed this rule in numerous clients, retreating our Fractional CISO to that of a Trusted Advisor for the internal security leader.
Thought Leadership: By staying abreast of the latest trends, they can also hope security vendors understand key trends within the industry, and client pain points.
Pros and Cons of a Fractional CISO
Pros
Cost Efficiency: A Fractional CISO provides high-level expertise at a fraction of the cost of a full-time hire. This is especially beneficial for smaller organisations that cannot justify the expense of a full-time CISO (L8CISO).
Flexibility: They can be engaged on a part-time or project basis, allowing organisations to scale their involvement based on specific needs.
Access to Diverse Expertise: Fractional CISOs often have experience across multiple industries and sectors, bringing a wealth of knowledge to the table ( as discussed in this article by Cyber Defense Magazine).
Unbiased Perspective: Being independent, they provide objective recommendations without internal biases.
Rapid Deployment: They can quickly step in during times of crisis, such as after a data breach or when facing tight compliance deadlines.
Cons
Limited Availability: Since they support multiple clients, their time is divided, which might result in slower response times during critical incidents.
Lack of Deep Integration: A Fractional CISO may not have the same level of organisational knowledge or cultural alignment as a full-time CISO.
Dependency Risk: Organisations may become reliant on the Fractional CISO without building internal capabilities, leaving gaps if the engagement ends.
Not Always On-Site: Depending on the engagement model, they may not always be physically present, which can limit their ability to build relationships with key stakeholders.
While the pros often outweigh the cons, businesses should carefully evaluate their specific needs and ensure they choose a Fractional CISO with the right expertise and approach.
The Bottom Line
A Fractional CISO is a powerful resource for organisations seeking expert guidance without committing to a full-time hire. They bring strategic vision, hands-on experience, and industry connections that can transform your cybersecurity posture.
If your organisation is looking to strengthen its defences, a Fractional CISO might be the missing piece.
Our Engagements
At ICA Consultancy Ltd we offer CISOaaS as part of our Capability-as-a-Service service line. "How is that different?!?" I hear you ask excitedly....
Well, it's sort of a blend. Our clients get the same individual to support them in the core role, but they are supported by the wider team. For example, swapping out some time for an Enterprise Security Architect to respond to a technical ask.
Under the CISOaaS offering my team at ICA Consultancy Ltd work closely with clients to:
Assess current cybersecurity posture, set targets and identify priorities.
Develop and implement tailored security strategies.
Support the implementation of security improvements.
Guide organisations through compliance frameworks like DORA, NIS2, and Data Protection.
Provide ongoing advice to align security with business goals.
Develop security cultures, through human risk management and broader risk management activities.
Address emerging challenges, such as AI governance and security risks.
Our approach ensures that even smaller organisations can access top-tier expertise. As I discussed with IT Brew, What to look for in a Virtual CISO.
The majority of customers we support are either in a highly regulated industry, process some level of personal data (this does not need to be significant), or [are] a growth business that is looking to protect their investments/IP
If you are interested in learning more about our CISOaaS service, or you are a CISO looking to change gear, then reach out to me or contact the team.
Comments