What is the difference between a vCISO and a consultant?

The security knowledge can be identical — plenty of consultants are former CISOs. What differs is the shape of the engagement. Consulting is scoped to an artifact: assess this, document that, remediate these. When the statement of work completes, so does the accountability; the findings, the auditor’s follow-ups, and next quarter’s questionnaire all belong to you again.

A vCISO signs up for a standing role. There is no “between engagements” — the audit calendar, the buyer calls, and the surprise incident all land on the same named person, quarter after quarter. Continuity compounds too: by month six they know your environment well enough that decisions take minutes, where a returning consultant would open with another discovery phase.

Consultants remain the right buy for bounded problems: a point-in-time architecture review, a niche assessment, an expert second opinion. The mistake is buying a deliverable when what you need is an owner. The standing role is described in what a vCISO does; Agency’s version — where the leader arrives with an execution team rather than a report template — is on the vCISO services page.