Virtual CISO · Retained · Board-level
Security leadership,for the organisationsthat cannot hire it.
A named, experienced security leader for a fixed number of days a month. Someone who has sat where your board sits, written the papers, faced the regulator and knows which of the hundred things on the list matter this quarter.
Former FTSE 100 CISOBoard and regulator experienceFrom two days a month
Strategy you can afford. Judgement you can borrow.
Most organisations between fifty and two thousand people cannot justify a full-time CISO, and should not try. What they need is direction: a plan, a risk register that reflects reality, board reporting that builds confidence, and a calm voice when something goes wrong. That is what the retainer provides — backed by a SOC, a testing team and an incident response unit when the plan needs hands.
- Format
- 2, 4 or 8 days per month · 12-month terms
- Named lead
- Yes — the same person every month, with a deputy for cover
- Escalation
- Incident leadership included; Disrupt team on call
- Reporting
- Quarterly board paper · Annual strategy · Risk register maintained
What a vCISO does
Strategy and roadmap
A twelve-month plan tied to the business, not to a vendor's product cycle.
Risk and governance
A risk register the board believes, policies people follow, and evidence for ISO 27001, Cyber Essentials and your regulator.
Board and executive reporting
Quarterly papers written for non-specialists; attendance at the meeting when it matters.
Supplier and customer assurance
Due diligence on your suppliers; answers to the questionnaires your customers send you.
Insurance and regulators
Renewal questionnaires, DORA and NIS2 obligations, FCA and ICO correspondence.
Incident leadership
When it happens, a leader who has done it before runs the response with your executives, briefing the board in risk terms rather than jargon.
Questions
How is this different from consulting?
Consulting delivers a project and leaves. A vCISO stays, owns the plan and is accountable for progress month after month.
Who will we actually get?
A named senior practitioner with CISO experience at listed companies; the same person for the life of the retainer, with a deputy for cover.
Can the vCISO oversee our other suppliers, including you?
Yes, and we encourage it. The retainer is independent of our other services; if another SOC or tester suits you better, the vCISO will say so.
Start a conversation
Borrow a CISO for an hour first.
A free hour with one of our vCISOs to look at your current position and tell you what we would prioritise.