Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Cybersecurity Companies Are Adopting the CISO as a Service Model
Transcript
- Lucas: So we talk a lot on this show about the security tools companies buy — endpoint detection, cloud security, threat intel feeds. But there's a quieter shift happening in how companies actually structure their security leadership. Luna: You're talking about the virtual CISO model — hiring a fractional security executive instead of a full-time one. Lucas: Exactly. And it's not just for startups anymore. The vCISO market has grown to over one and a half billion dollars globally as of last year. Mid-sized companies — say, five hundred to five thousand employees — are increasingly choosing to outsource the CISO role rather than compete for a full-time hire in a brutally tight talent market. Luna: I've seen numbers suggesting there are about twenty thousand open CISO roles in the US alone. So the supply-demand gap is real. Lucas: It's staggering. And the vCISO model solves a couple of problems at once. First, cost. A full-time CISO at a mid-market company can command three hundred to five hundred thousand dollars in total compensation. A vCISO retainer might run fifty to a hundred and fifty thousand a year, depending on hours. Second, expertise — a vCISO firm can pool talent across multiple clients, so you get access to specialists in cloud security, compliance, incident response, all bundled. Luna: But that also means the vCISO isn't in the building every day. How do they really own security when they're not living the culture? Lucas: That's the big tension. The model works best when the company has a solid internal IT team that can execute on the strategy the vCISO sets. The vCISO becomes more of a fractional strategist and board-level advisor. They set the roadmap, oversee the compliance audits, help with vendor risk, and then during an incident they're the one leading the response call. Luna: So it's less about being the hands-on keyboard and more about providing the strategic framework? Lucas: Exactly. And some firms are building really sophisticated delivery models for this. Take Coalfire — they have a dedicated vCISO practice with hundreds of consultants. They'll assign a primary vCISO to a client, but you also get access to their broader bench. So if you need a deep dive on FedRAMP compliance or a ransomware tabletop exercise, you pull in the specialist. Luna: Then there's SecurityScorecard, which started as a ratings platform but now offers vCISO services as a way to act on the data they're already collecting. Lucas: Right. Their pitch is: we can see your security posture from the outside, and we can tell you exactly where you're weak. Why not let us help you fix it? That's a pretty compelling upsell. Luna: But I wonder about liability. When a full-time CISO makes a mistake, the company sues the CISO — or their errors and omissions insurance. With a vCISO, who owns the risk? Lucas: That's a live question. Most vCISO contracts have clear scopes of work and disclaimers. The vCISO is responsible for the advice they give, but the company is responsible for implementing it. If the company ignores a recommendation and gets breached, the vCISO is usually protected. But there's been litigation — I know of at least two cases in 2024 where a plaintiff tried to pierce that veil. So the industry is still sorting this out. Luna: What about the cultural fit? I've seen vCISOs parachute into a company and get treated like outsiders by the engineering team. Lucas: Yeah, that's the classic ' security is a people problem ' challenge. A good vCISO spends significant time upfront building relationships — attending all-hands, doing lunch and learns, getting face time with the CEO. But if the company treats them as just a vendor, it fails. The ones that work best embed the vCISO into the leadership team with a regular cadence. Luna: It sounds like the vCISO model is really a bet on the idea that security leadership is more about domain expertise and process than about being a full-time employee. Lucas: Exactly. And the economics support that bet for a lot of companies. If you're a five-hundred-person company doing fifty million in revenue, you might not need a full-time CISO. You need someone to build your program, guide you through SOC 2 or ISO 27001, and be on call for incidents. That's maybe twenty hours a week. A vCISO fits perfectly. Luna: But as the company grows, at what point does it flip? When do you need a full-time CISO? Lucas: There's no hard rule, but I've seen a rough threshold around a thousand employees or a hundred million in revenue. At that scale, security becomes a full-time job just managing the internal team and board expectations. Also, regulators and cyber insurers start expecting a dedicated executive. A vCISO can still work at that stage, but usually as a supplement to an internal CISO, not a replacement. Luna: So it's more of a stair-step. You start with a vCISO, then hire a deputy, then eventually a full CISO. Lucas: Exactly. And some of the vCISO firms are building that into their model. They'll say: we'll be your CISO until you're ready to hire one, and then we'll help you interview and onboard that person. It's almost a talent pipeline service. Luna: I've noticed the big consulting firms are getting into this too. Deloitte and PwC have vCISO offerings now. That legitimizes the model but also squeezes the smaller players. Lucas: It does. The small boutique vCISO firms differentiate on intimacy — you get the founder as your CISO, not a junior consultant. But the big firms have the brand and the breadth. It'll be interesting to see how the market segments. Luna: Before we go further, I want to circle back to something you mentioned about the economics. These shows we do — they take real time to research and produce. And they're ad-free, which is a choice we made. Lucas: It is. And the way they stay that way is listener support. A couple of dollars a month is genuinely what keeps these going — buy me a coffee dot com slash fexingo, if you've gotten something out of them. Luna: Yeah, it's a small thing that makes a real difference for us. So if this show is useful for what you're building or running, that's the place. Lucas: Alright. Back to vCISOs. One area where the model is really proving itself is incident response. When a breach happens, having a vCISO who's already been inside your environment for months — who knows your systems and your people — is way more effective than calling in a pure incident response firm cold. Luna: So the vCISO becomes the trusted quarterback during a crisis? Lucas: Exactly. They know who to call, they know the legal team, they probably already have the cyber insurance carrier's requirements documented. That cuts the response time dramatically. In one case I read about, a company with a vCISO contained a ransomware attack in under six hours because the vCISO had already pre-staged backups and had the runbook ready. Without that, it could have been days. Luna: That's a concrete example of why the model works. But I'm still skeptical about long-term strategic planning. Can a part-time executive really own a three-year security roadmap? Lucas: It depends on the engagement. Most vCISO contracts are annual, renewable. So if the relationship is stable, the vCISO can absolutely own the roadmap. They're there for the quarterly board meetings, they see the audit results, they adjust the plan. The real risk is turnover — if the vCISO firm reassigns your person every year, you lose continuity. The best firms guarantee continuity of the primary vCISO. Luna: So it comes down to how the contract is structured. What should a company look for when hiring a vCISO? Lucas: First, check the firm's incident response track record. Ask for case studies — but anonymized. Second, make sure the vCISO has experience in your industry. Healthcare compliance is very different from fintech. Third, look at the backup team. If your primary vCISO is on vacation and a breach happens, who steps in? That person should be just as qualified. Luna: And reference calls — talk to current clients, not just former ones. That's where you'll hear about the real relationship. Lucas: Absolutely. And one more thing: don't treat the vCISO as a checkbox for compliance. If you hire a vCISO just to pass an audit, you're wasting the money. The real value is in having someone who can actually improve your security posture over time. Luna: So the vCISO model is not a silver bullet. It's a solution for a specific set of companies at a specific stage. But it's clearly here to stay. Lucas: I think so. As the talent shortage persists and the threat landscape gets more complex, more companies will turn to fractional leadership. The question is whether the market will consolidate into a few big players or remain a long tail of boutiques. Luna: Either way, it's a fascinating shift in how companies think about security — from owning the person to owning the outcome. Lucas: That's the key insight. And it mirrors what we've seen in other parts of the business — fractional CFOs, fractional HR. Security is just the next frontier.