Virtual & Interim CISO

Security leadership as a service: we take on strategy, budget responsibility, board reporting and the management of your service providers, either permanently as your virtual CISO or on an interim basis to bridge a vacancy. You buy in C-level leadership that rolls up its sleeves instead of just describing, in exactly the scope your company really needs.

In most mid-sized companies, information security sits where it historically ended up: with the head of IT, who carries it alongside operations, projects and day-to-day business. That works for a while, but it has structural limits. There is no time for strategy, risk decisions and board reporting, and no distance for a critical view: whoever runs the systems ends up assessing their own work. And without a clear mandate, security remains the topic that always takes a back seat to the next outage.

At the same time, responsibility for information security now lies explicitly with senior management. Section 38 of the BSI Act (BSIG) obliges the management bodies of entities covered by NIS2 to implement the risk management measures and to monitor their implementation; those who fail to do so are personally liable to their own entity under company law. On top of that comes a regular training obligation: management must be able to assess risks and risk management themselves. DORA sets out equivalent requirements for the financial sector. This responsibility stays with you, regardless of how you fill the role. That makes it all the more important who fills it day to day. Small and mid-sized companies in particular need someone in this position who thinks commercially: many security officers demand what the textbook requires without asking what the business can bear. A good CISO knows that money has to be earned before it can be spent, and prioritizes security by what really protects the business. Profiles that master the threat landscape, budgets and boardroom language in equal measure are rare, and in the competition for them, mid-sized companies are up against large corporations and consultancies.

There is also a structural problem: the strategic CISO work of a mid-sized company rarely fills a full-time position. Security strategy, risk decisions, board reporting and vendor management can be handled in a few days per month if they are done consistently. A full-time hire therefore almost inevitably leads to one of two scenarios: either you pay for expensive excess capacity, or the role gets filled up with operational tasks and the leadership work is left undone.

The gross salary is only the visible part of the bill. If you want to compare the cost of a full-time hire honestly, you have to look at the full cost:

Employer social security contributions

The employer’s share of social security contributions comes on top of every gross salary and, for executive salaries, quickly adds up to a five-figure annual amount.

Recruiting and vacancy

Experienced CISOs are almost always hired through executive search firms whose fees are based on the annual salary. Then there is the vacancy period: months in which the role is unfilled while management’s responsibility continues.

Training, certifications, conferences

A CISO is only as good as their current threat picture. Certifications, training and conferences are ongoing costs that are included in the hourly rate of a virtual CISO. Then there is what cannot be bought: a virtual CISO learns across many engagements and brings experience from different industries and environments, while an in-house CISO only sees their own organization.

Absence and wrong-hire risk

Vacation, illness, resignation: with a one-person role, everything then comes to a standstill. And a wrong hire at C-level costs not only the salary but lost time that nobody can recover in the security program.

Long-term commitment and employment protection

A permanent position is a commitment for years: an employed CISO rightly enjoys protection against dismissal, and a separation means notice periods, often a severance payment and months of uncertainty in a sensitive role. An external engagement, by contrast, adapts to demand and ends at the agreed notice period when it no longer fits.

On the other side is the virtual CISO: available immediately, at senior level from day one, billed only for work actually done, scalable when an audit, a project or an incident temporarily requires more capacity, and without the long-term commitment of an employment relationship. Compare both models with your own numbers:

As your virtual CISO, we take over the leadership role completely, not just in an advisory capacity. We know the objection: then we just have someone who writes documents, and nothing changes. That is exactly what we will not sign up for. For us, paper is a means, never the result: we drive measures through to implementation, sit at the table in vendor negotiations and in the crisis room, check for ourselves whether detection and processes really work, and measure ourselves by impact rather than by the state of the documentation. Hands-on is not a package description for us but the mindset of the whole company. In particular, the role covers:

• Security strategy and annual planning: prioritized by threats instead of following the audit calendar
• Board reporting: risk and status reports in the language of management, prepared so that decisions can be made
• Budget responsibility: justifying and prioritizing security spending and defending it to management
• Vendor management: leading the SOC, MSSP, pentest providers and IT partners with clear requirements
• Crisis readiness: management’s point of contact during a security incident, with a rehearsed escalation path
• Regulators and customers: filling the role verifiably to the outside world, from the customer audit request to the authorities

The model adapts to your situation: permanently as a dedicated virtual CISO with an agreed monthly allotment, or on an interim basis to bridge a vacancy until you have filled the position internally. If you already have an information security officer or a security manager, we lead these roles professionally instead of replacing them. And if you want to fill the role internally in the long term, we build it so it can be handed over: documented, structured and without dependence on us.

Honesty also means saying this: an external engagement does not work against the organization, only with it. We need a reliable point of contact on your side, business units and IT that supply information, and named owners who implement measures in their systems. This cooperation is not small print but the condition for security being created in your company rather than in our folders.

And when things are on fire? That is precisely when the strength of the model shows. In an emergency, a single employee may be on vacation, ill or long gone. In the engagement, we agree on availability for security incidents, and behind your virtual CISO stands our entire incident response experience: threat picture, containment, recovery and communication with regulators, customers and insurers. The incident does not hit you with a one-person defense but with well-practiced reinforcements.

With us, you do not get an anonymous pool of consultants but proven leadership experience: our founder was named CISO of the Year 2026 and held the role for years in an international group of companies, between regulatory requirements, budget reality and technical operations. You buy in this experience on a fractional basis, at a fraction of the cost of a full-time hire.

In substance, we lead according to the approach that shapes our entire company: Threat-Informed Defense. Your security strategy is aligned with the techniques of real adversaries, not with checklists. That makes priorities justifiable, budget decisions defensible and your program measurably more effective. Compliance with NIS2, DORA or ISO 27001 is then the result of good security work, not its purpose.

The market for virtual CISOs is growing, and the offerings differ considerably. Before you commit, it pays to take a sober look at five points. They are the same questions by which you may measure us too:

Regular, visible results

An engagement that is working leaves traces: status reports, committee meetings, measures that are followed up. If a provider cannot say what you will concretely have in hand every month, you are buying availability instead of leadership.

Clearly defined scope

What does the allotment cover, what is commissioned separately, and on what terms? Flat monthly fees without a description of services end either in disappointment or in change orders.

Clear responsibilities

Who decides, who supplies, who implements? A serious offering also names what remains with the customer, above all the non-delegable responsibility of management.

Expertise behind the person

No individual masters regulation, cloud hardening, detection and crisis management equally. Ask what knowledge your CISO can draw on when things get specialized.

Deputies and handover

What happens during vacation, illness or at the end of the engagement? Documentation belongs in your systems, and knowledge must be transferable. Dependence is not a business model but a warning sign.

Our engagement model is built along exactly these points: fixed scope, fixed term, results we can be measured by, and our entire company behind the person.

As convinced as we are of the model, it does not suit everyone. A virtual CISO does not make sense if:

• your organization is so large or so regulated that security leadership is a daily full-time job, with its own security team, its own SOC and a constant presence on site. Then the role belongs in-house; at most, we bridge the time until it is filled.
• you are looking for someone to take responsibility off management’s hands. No CISO can do that, whether in-house or external: NIS2 and DORA explicitly leave this responsibility with management.
• the role in your company mainly means daily operational work: administering systems, handling tickets, supporting users. For that, a CISO is the wrong and too expensive tool; a security manager or a strengthened IT team is a better fit.
• there is no foundation in place yet and the budget for a continuous leadership role is lacking. In that case, a two-day strategy workshop with a prioritized roadmap achieves more than a permanent engagement.

Whether your case is one of them is something we clarify in the initial consultation, openly and without sales pressure. If a different model fits better, we will tell you so and recommend it even if we earn nothing from it.