Fractional, interim and contract CISOs: what the sources do and don't say

What the documents cover, and what they do not

The question asks what a fractional (virtual), interim or contract CISO is, when organizations use one instead of a permanent hire, and how the role relates to the path to a full-time seat. The three documents supplied for this guide do not answer the first two parts. None of them uses the terms "fractional," "virtual," "interim" or "contract" for a CISO. None describes why an organization would choose one over a permanent hire.

All three documents concern one company, MicroAge, and one executive, Alex Ryals. Two are company announcements, dated August 5, 2024 and January 8, 2025. The third is a blog post dated May 27, 2025, written under Ryals's byline.

This guide therefore does not define the three models, because the documents give no definition and the guide uses nothing else. It reports what the documents establish about a permanent, internal promotion to the CISO seat. That is the full-time path against which any fractional, interim or contract arrangement would be compared. It also lists the questions the documents leave open.

The full-time seat: the January 8, 2025 announcement

The ACCESS Newswire announcement is dated January 8, 2025. It says MicroAge is announcing the promotion of Alex Ryals to Chief Information Security Officer.

The announcement describes MicroAge as a full-service solutions integrator.

It also says Ryals held a different title before the promotion. He had been MicroAge's Vice President of Cybersecurity Solutions and Strategy.

The announcement states what the company says the appointments show. It says they underscore a dedication to "fostering leadership excellence from within."

On scope, the announcement says Ryals will spearhead efforts to strengthen security frameworks and safeguard client operations.

The announcement does not give a contract type, a number of days per week, a term or a reporting line. It does not say whether the seat had been filled on a temporary basis before. It calls the move a promotion, and it places that promotion in the company's own account of promoting from within. That is all it says about how the seat was filled.

The step before: the August 5, 2024 appointment

MicroAge's own announcement is dated August 5, 2024. It covers an earlier step in the same career. The company said it was appointing Ryals as Vice President of Cybersecurity Solutions and Strategy.

The announcement says he succeeded a predecessor in a related post. Andrew Roberts, the company's Chief Cybersecurity Strategist, was retiring.

It describes Ryals's experience before joining. It says he came with more than 20 years in the technology sector.

His previous employers are named in the announcement. One was Ping Identity, where he was Global VP of Channel Sales.

The announcement describes the job he was hired into as a team-leading role. It says Ryals would lead a team to make sure client solutions include security.

It also lists his education. He holds a Bachelor of Computer Science from Auburn University.

Outside his main job, the announcement says he sits on two startup advisory boards.

Taken together, the two announcements show one route to the top security title in this company. The person was hired into a senior cybersecurity leadership role on August 5, 2024. The company announced the CISO promotion on January 8, 2025. The documents do not say what the company's CISO arrangements were between those dates. They also do not say whether anyone held the CISO title before Ryals.

What the new CISO writes about: the May 27, 2025 post

The third document is a blog post published on MicroAge's site on May 27, 2025. The byline identifies the author as Alex Ryals, Chief Information Security Officer. The author note on the same page repeats his experience.

The post is about governance, risk and compliance (GRC) platforms. It is not about CISO employment models. It opens by addressing CISOs and senior risk management professionals and says the stakes for GRC are high.

The post advises readers on how to start an evaluation of such a platform. It says to consider what the primary challenge is.

It also states a condition for adoption.

These passages show the kind of topics the post's author addresses as CISO: compliance programs, frameworks and tooling decisions. The post does not say who does this work in organizations without a full-time CISO. It does not mention part-time or outside security leadership. This guide draws no conclusion from the post about those models.

What this means for the question

The documents support one narrow point about the path to a full-time security seat. In this company, the seat was filled by a promotion. The person promoted had joined less than six months earlier in a cybersecurity leadership role, according to the dated announcements. The company's own statement describes the promotion as leadership developed "from within."

The documents support nothing further about fractional, interim or contract CISOs. The questions below are not answered in the supplied material:

• What a fractional or virtual CISO is, and how it differs from an interim or contract CISO.
• The circumstances in which an organization chooses one of those arrangements over a permanent hire.
• Whether holding one of those roles leads to a full-time seat.
• Whether MicroAge used any such arrangement before January 8, 2025.

A guide that answers those points needs documents that address them. The announcements and the post cannot stand in for that evidence.

Sources used

• ACCESS Newswire announcement, January 8, 2025: the promotion of Alex Ryals to Chief Information Security Officer and of Rick Trujillo to Vice President, Data Intelligence and Service Engagement.
• MicroAge announcement, August 5, 2024: the appointment of Alex Ryals as Vice President of Cybersecurity Solutions and Strategy.
• MicroAge blog post by Alex Ryals, May 27, 2025: GRC platforms and cyber resilience.

The January 8, 2025 announcement also covers a second promotion. It says Rick Trujillo, a MicroAge associate for over 12 years, moved from Director of Services to Vice President, Data Intelligence and Service Engagement. That promotion is outside the question and adds nothing about CISO models.