How much does a vCISO cost?

Because “vCISO” names a title, not a quantity. One buyer wants a monthly sanity check on security decisions; another wants an entire security function carried — frameworks, audits, buyer reviews, incident readiness. Any market average flattens those into one meaningless figure, which is why credible providers ask about scope before they talk price, and why rate cards found online say more about the marketer than the market.

The four models buy different things. Hourly buys answers and bills every question. A retainer buys a fixed slice of a leader’s month — strategy and meetings, with implementation usually excluded. Project pricing buys a bounded deliverable, like a gap assessment. Bundled pricing buys the leader and the execution team together, so the roadmap and the work it creates sit under one price. The cheapest-looking model and the cheapest total are rarely the same one.

Agency only sells the bundled shape: vCISO leadership built into a managed compliance program, with engineers doing the recurring work under the same agreement. For startups there is no quoting step at all — published packages span $2,500 to $12,500 depending on stage, with the GRC platform, audit, pen test, and operated program inside that number. The published tiers — a full vCISO with up to three standard frameworks, from $5,000 per month for companies with 1–100 employees — are on the Managed Comply pricing page.