Fractional and virtual CISO, explained: what they do and how to evaluate one

A fractional CISO works part-time but on-site, embedded in a company's own leadership meetings; a virtual CISO (vCISO) delivers the same kind of security leadership remotely, on-call. Both exist because a full-time chief information security officer is out of reach for most companies: the 2026 CISO Report from Cybersecurity Ventures, published in partnership with the security vendor Sophos, puts the worldwide CISO headcount at roughly 35,000 against about 359 million businesses in operation — a gap Sophos CEO Joe Levy calls "a market failure."

Why do companies turn to a fractional or virtual CISO at all?

Mainly cost. The 2026 CISO Report puts a qualified full-time CISO's pay at $250,000 to $400,000 a year, citing a LinkedIn post by David D. Love, head of security operations at Verizon — a figure most small and midsize businesses simply cannot carry on payroll. A vCISO engagement, by contrast, runs roughly $40,000 to $120,000 a year in the same report's estimate, turning a fixed payroll cost into a flexible, scaled-back operating expense.

Gartner's own 2021 analysis of the market frames the same trade-off from an organizational-design angle rather than a pure cost one: with total cash compensation for a traditional CISO then running $208,000 to $337,000, Gartner VP Analyst Jeffrey Wheatman said companies that "need to fill the need for leadership but are not in a position to bring in a full-time and often very costly qualified CISO" increasingly turn to a virtual option instead.

What does a virtual CISO actually do, day to day?

Gartner describes the role as a hybrid of four functions: traditional staff augmentation (an on-site or virtual presence in meetings, operations and strategy planning); consultative engagement to build and run security and risk program artifacts, such as roadmaps, architecture and policy; project management of deploying security and risk solutions; and coaching or advisory work to train a company's own full-time staff to carry the program forward.

Wheatman frames the value this way: a virtual CISO "can help by sitting outside the tactical day-to-day activities," providing "vision and guidance to drive a more programmatic approach" rather than getting pulled into hands-on operations.

Is "fractional CISO" just a different name for the same thing?

Largely, yes, with one consistent distinction across how the two terms get used: a fractional CISO is typically described as embedded on-site, sitting in the company's own leadership meetings part-time, while a virtual CISO is remote and on-call. The 2026 CISO Report draws that same line, and both exist to deliver security leadership below the cost of a full-time hire rather than describing two different scopes of work.

One limitation worth naming before comparing providers: Sophos' own President of Products and Marketing, Raja Patel, points out that "the challenge with the vCISO offerings in the market today is that human bandwidth doesn't scale infinitely" — a single vCISO, or a single provider spread thin, can only cover so many clients at once, especially if several need attention during the same incident.

What should a company define before signing a vCISO contract?

Gartner's own recommendation to midsize-enterprise CIOs is to set the scope in writing before the engagement starts: decide whether the vCISO covers the entire security program or only specific areas, such as governance or incident response, and specify which compliance frameworks or regulatory regimes (Gartner names NIST, ISO, CIS, HIPAA, PCI DSS and GDPR as examples) any gap-analysis work will be measured against. Gartner's own stated reasoning is that a security program touches so many moving parts that an undefined scope tends to drift and unnecessarily prolong the engagement.

Two things stay with the company no matter how the contract is written. First, responsibility: a vCISO engagement outsources strategic and tactical effort, not the company's own legal and business responsibility for its cyber risk. Second, authority: Gartner's guidance stresses that the vCISO needs real operational and enforcement authority for security mandates, and a defined reporting line to senior leadership, or the role risks shrinking into technical advice nobody with budget authority actually acts on.

Does this replace the case for a full-time CISO as a company grows?

Not according to either source cited here. The 2026 CISO Report notes nearly every Fortune 500 and Global 2000 company already employs a full-time CISO, and that 40% of Fortune 500 companies now also have a deputy CISO or equivalent role beneath that seat — the fractional and virtual model exists specifically to serve the much larger population of small and midsize companies that a full-time hire, at six figures a year, doesn't reach.

This site's own guide to becoming a CISO and tenure record both describe the full-time, single-company seat; a fractional or virtual engagement is a different, usually earlier, rung on the same ladder — several vCISO providers are themselves staffed by people with prior full-time CISO experience, moving between company and contractor the way a seat holder in the tenure record moves between companies.

Where do the facts on this page come from?

The headcount, compensation and definition figures come directly from the 2026 CISO Report (Cybersecurity Ventures, in partnership with Sophos) and from Gartner's own 2021 public article on the topic, read directly this run rather than from a vendor's marketing page describing either study secondhand. The 2026 CISO Report is vendor-sponsored, so its market-sizing claims are stated here as that report's own figures, not as independently verified counts.