How much does a fractional CISO cost? 2026 rates, retainers, and pricing models

A fractional CISO, often called a virtual CISO or vCISO, is a part-time security leader. For a mid-market manufacturer or distributor, the useful question is not the title. It is which security decisions are stuck, how many hours those decisions need, and what the fee actually buys.

Every dollar figure below comes from a public source linked in the text and listed at the end. These are market ranges, not EdgePoint’s prices. Your cost depends on scope, sites, and the requirements customers, insurers, or defense contracts place on you.

The short answer

There is no reliable single average. vCSO.ai compiled what providers publish and states plainly that no independent survey of actual vCISO invoices was found. Treat every headline number as provider-reported, and read what is included before you compare two quotes.

With that limit in mind, the public figures cluster like this:

• Monthly retainers. vCSO.ai describes mid-market retainers as clustering roughly between $3,000 and $12,500 a month. The wider published span runs about $2,000 to $20,000.
• Hourly advisory. vCSO.ai lists $175 to $600 an hour. SideChannel, from its own engagements, lists $200 to $400.
• A live rate benchmark. Go Fractional, updated November 2, 2026, reports an average of $201 an hour. The middle 50% of observed rates sits between $150 and $240. The sample is 5 job posts and 103 candidate profiles over 90 days.
• Project fees. vCSO.ai lists fixed-scope work, such as an assessment or a policy set, from $5,000 to $75,000. SideChannel’s own project range is $10,000 to $75,000.

Go Fractional turns that hourly band into $7,800 to $12,400 a month by assuming 13 hours a week. It says those hours are typical fractional scope across roles, not a CISO-specific finding. Use the hourly rate, and apply your own hours.

How fractional CISOs are priced

The fractional CIO cost guide describes the same three models for technology leadership. Security work uses them too, with compliance and incident response pushing the hours up.

Monthly retainer. A fixed fee for a set of hours, a meeting cadence, and a list of responsibilities. Use it when questionnaires, insurer reviews, incidents, and provider follow-up keep arriving. Before you compare two retainers, ask how many hours are included, what an hour above the cap costs, and which months run hot. vCSO.ai notes published overage rates around $250 to $400 an hour. A low retainer with a tight cap can invoice like a larger engagement in a busy month.

Hourly advisory. You pay for time used. It fits a second opinion, a board briefing, or help during one incident. It is a weak way to run a program all year, because context never accumulates and the invoice is hard to forecast.

Fixed-fee project. An agreed fee for a defined deliverable: a risk assessment, a first policy set, a customer-response pack, or a readiness review for one framework. This is a practical way to start. Both sides see the real scope before a monthly cadence.

What drives the price

Headcount is a weak predictor by itself. vCSO.ai makes that point with two providers’ published bands, which agree at the edges and diverge in the middle. A 40-person company with ordinary commercial work is a different assignment from a 40-person company racing a defense-customer review.

Use the table as a planning envelope, then price the work. For a manufacturer or distributor, the factors that move the fee are:

1. Hours and response. A monthly briefing costs less than a leader who joins incident calls and the weekly operations meeting.
2. Sites and the plant floor. Extra warehouses, a separate plant network, and operational technology add access paths and recovery questions.
3. Customer, insurer, and contract requirements. SideChannel says regulated industries, and companies pursuing several frameworks at once, commonly run $10,000 to $20,000 a month in its engagements. vCSO.ai, citing Zip Security, lists government contractors working toward CMMC around $12,000 to $18,000 a month. One commercial questionnaire is a smaller assignment.
4. What you already have. A capable MSP, an internal IT lead, and a backup you have actually restored reduce the leadership hours.
5. Who does the hands-on work. Advisory costs less than a scope that also expects the CISO to configure tools. Implementation is often separate.
6. Relevant experience. Someone who has already separated office IT from production systems spends less of your time learning the floor.

What is included at different levels

The same monthly number can buy different work. SideChannel publishes one version of the split. At the low end it describes an assessment, a small policy set, a monthly check-in, questionnaire help, and guidance for one framework. In the middle it adds a compliance program, more frequent meetings, vendor review, an incident plan with a tabletop, and periodic reporting. At the high end it adds board briefings, several frameworks at once, budget and insurance support, and on-call incident availability. Other firms draw the lines elsewhere.

Make your own inclusion list and ask every bidder to mark yes, no, or extra:

• The systems and information the business cannot ship or invoice without
• A short risk list in operating language, each item with an owner
• A written split of duties among the company, the MSP or MSSP, and the fractional CISO
• Help with the customer, insurer, or CMMC requests that have a date on them
• One recovery test or tabletop tied to your plant or warehouse
• Who is on the call when an incident starts after hours

Common extras, often outside the retainer: endpoint protection, backup, and email security; penetration tests and formal audits; the labor to change configurations; a GRC product the provider prefers. Ask for those lines before you sign. A low retainer can assume you already employ the people who will do that work.

Fractional CISO, full-time CISO, or an MSP add-on

These are three different purchases. A fractional or virtual CISO owns priorities, decisions, provider accountability, and reporting for the hours you buy. A full-time CISO does that and manages a security function every day. An MSP or MSSP security add-on runs tools: monitoring, patching, licenses, and backup jobs. The add-on is useful, and it does not decide which risk the owner accepts. Fractional CIO vs managed IT provider walks through that split. The provider runs the service. The security leader decides the program and checks the work.

The closest public pay survey for people who already hold the senior security role is from IANS and Artico Search. Their June 17, 2025 benchmark, from the 2024 survey, reports average total compensation of $415,000 for CISOs at organizations with annual revenue under $1 billion, based on 363 small and mid-market respondents. That is not a quote for your next hire. It does show why a part-time retainer and a full-time package are far apart.

Two Bureau of Labor Statistics medians are nearby occupations, not CISO salaries. Information security analysts show a May 2025 median of $129,180. Computer and information systems managers show $175,140. Go Fractional loads the manager median with BLS benefit data and estimates about $250,000 for a full-time hire, against about $124,800 a year for a fractional CISO at its 13-hour assumption. Price the job in front of you.

A fractional CISO can sit alongside a fractional CIO. In a smaller company, security governance often starts there. Give it a separate owner when questionnaires, CMMC, insurance, and incidents are enough work on their own.

How to decide

1. Write the unresolved decisions. A customer security exhibit, an insurance control list, an untested backup, shared logins on the floor, a renewal you do not understand, or a contract that mentions CMMC.
2. Mark who can act. For each item, name who can do the technical work and who may accept the remaining risk. A blank in the second column is a leadership gap.
3. Pick the time model. A few hours, a defined project, or a standing cadence. If you cannot tell, buy the project. An assessment that ends in a prioritized list beats a retainer with a vague mission.
4. Put exclusions on the same page. Tools, tests, audits, and implementation labor belong next to the retainer.
5. Choose full-time only if the hours stay full. A half day a week does not fill a salary. Daily management of people and incidents does not fit a thin retainer.
6. Review at 90 days. Keep, shrink, or stop. The test is whether decisions were made and the agreed work moved.

Questions to ask before you sign

• What will you deliver in the first 90 days, and what will you leave alone?
• How many hours does the fee include, what happens above that, and who answers on a Saturday shift?
• How will you work with our IT lead, MSP, or MSSP, and who may direct them?
• Which tools, tests, and projects are outside the fee?
• Who owns the policies, the risk register, and the evidence if the engagement ends?
• How many other companies is this person supporting?

How EdgePoint approaches it

EdgePoint provides fractional CISO services for mid-market manufacturers and distributors. Scope, cadence, and fees are agreed in writing before work begins. An initial conversation is free and is separate from paid work. To sort out which model fits the next decision, start a conversation.

Sources

Accessed November 2, 2026. Check each page for what the figure includes.

• vCSO.ai, 2026 vCISO Pricing Benchmark: Published Rates. Provider-published rates. The page states that no independent invoice survey was found.
• Go Fractional, Fractional CISO Cost and Rates. Rolling 90-day benchmark, updated November 2, 2026.
• SideChannel, vCISO Pricing in 2026. That firm’s engagements, not an industry survey.
• IANS and Artico Search, 2025 Compensation and Budget for CISOs in the Small and Middle Market.
• U.S. Bureau of Labor Statistics, Information Security Analysts and Computer and Information Systems Managers, May 2025 median wages.

Frequently asked questions

How much does a fractional CISO cost?

There is no single market average, because no independent survey of paid invoices was found in public sources as of 2026. vCSO.ai compiled provider-published rates and found mid-market monthly retainers clustering roughly between $3,000 and $12,500. Go Fractional's live benchmark, updated November 2, 2026, puts the average hourly rate at $201, with a middle band of $150 to $240 an hour. These are third-party ranges, not EdgePoint prices.

Is a virtual CISO the same as a fractional CISO?

The terms are often used for the same role: a part-time chief information security officer who is not on the company payroll. Read the scope, not the label. Ask which decisions the person owns, how many hours are included, what a heavy month costs, and which work stays with your IT staff, MSP, or MSSP.

Is a fractional CISO cheaper than a full-time CISO?

Usually, if the work is genuinely part-time. IANS and Artico Search report average total compensation of $415,000 for CISOs at organizations with annual revenue under $1 billion, from 363 small and mid-market respondents in their 2024 survey. A retainer buys a slice of that leadership. A full-time hire fits when security leadership is a daily management job.

Does a fractional CISO replace an MSP security add-on?

No. An MSP or MSSP security package typically runs tools: monitoring, patching, endpoint protection, and backup jobs. A fractional CISO decides which risks matter, sets the program, and checks that providers do the work. Many manufacturers and distributors need the operating service and the leadership role.

What should a fractional CISO retainer include?

Confirm hours, meeting cadence, the decisions covered, reporting, incident availability, and what is billed extra. Policies, a risk list, provider responsibilities, and help with customer or insurer requests are common. Tools, penetration tests, formal audits, and hands-on implementation are often outside the fee. Get the exclusions in writing.