The vCISO role exists because of a structural mismatch in the security talent market. Every organisation of meaningful size needs security leadership — someone to set strategy, own risk, engage with the board, and make the build-versus-buy decisions that shape the programme — but a full-time CISO is expensive, scarce, and often more capacity than a mid-sized organisation needs. A vCISO splits one experienced leader's time across several organisations, so each gets the expertise it needs at a cost proportional to its size. For many organisations, this is the model that makes genuine security leadership accessible.
What a vCISO does, concretely, is the work a CISO does. They develop and maintain the information security strategy aligned to business objectives. They run the risk-management programme — risk assessment, risk register, treatment plans, reporting to leadership. They own the compliance portfolio — ISO 27001, SOC 2, NIS2, DORA, GDPR, and sector-specific frameworks — and the relationships with auditors and regulators. They design and oversee the security programme, selecting controls and managed services, and they lead security incident response when it occurs. They report to the board or leadership in business language, translating technical risk into decisions the business can make. The difference from a full-time CISO is time fraction and employment, not capability.
The model works best when the engagement is structured and the scope is clear. A vCISO engagement defines what is included — typically strategy, risk, compliance, programme oversight, and executive reporting — and at what cadence, with defined monthly hours and deliverables. It works less well when an organisation expects a part-time leader to also be a hands-on engineer; the vCISO sets the programme and selects the partners and services that execute it, but the execution itself is delivered by those providers. The most effective vCISO engagements therefore sit alongside managed services — a SOC, an incident-response retainer, an offensive-security partner — that the vCISO directs and holds accountable.
A vCISO is particularly valuable for specific situations. Organisations scaling toward a full-time CISO often use a vCISO to build the programme and the case for the permanent hire. Organisations in regulated industries — financial services, healthcare, critical infrastructure — use a vCISO to own the compliance portfolio and the regulator dialogue. Private-equity portfolio companies use a vCISO to mature security ahead of an exit. And organisations that have suffered an incident use a vCISO to lead the post-incident rebuild of the programme. In each case, the vCISO brings experience the organisation does not have in-house and applies it to the specific situation.
Passeca delivers vCISO services in three tiers, from a basic engagement suitable for smaller organisations to an enterprise engagement for larger or more regulated environments. The vCISO sets strategy and risk management, owns the compliance portfolio, directs the security programme — including the managed services Passeca and others provide — and reports to leadership. The engagement is structured, with defined hours and deliverables, and is delivered by experienced security leaders rather than junior consultants. For organisations considering a full-time CISO, the vCISO engagement is also the most effective way to define what that role should do and to build the programme that will make the eventual hire successful.