vCISO: Your Chief Information Security Officer

That depends on scope and is agreed in advance — typically fixed days per month plus availability for decisions in between. A vCISO who covers everything on paper and is actually there two hours a month helps nobody; so we write the scope concretely into the contract.

They fill the role for as long as an in-house position is unfilled or does not pay off. As the organization grows, this often becomes onboarding for your own hire. We build the role to be handed over — that is the difference from a permanent dependency.

The management. Responsibility for security itself cannot be outsourced — it stays with you. What is outsourced is the professional work and the preparation of decisions, not the liability.

The vCISO takes over coordination and upward communication. The technical response runs through Instant Response; the two mesh because the same people already know the environment.

As soon as there is an obligation to evidence something, or a customer wants to see a named contact for security — which today applies to considerably smaller organizations than a few years ago. Below that threshold we would rather recommend individual components than a role nobody keeps busy.